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FOREWORD 

This report was prepared by the Lockheed Missiles & Space Company, 
Sunnyvale, California, and contains the results of a Lunar Hazards 
Analysis and Safety Requirements Study performed for the National 
Aeronautics and Space Administration, Manned Spacecraft Center, 
under Contract NAS9-10969, Lunar Mission Safety and Rescue Study. 
This is one of the following four reports documenting the contract 
findings : 

Lunar Mission Safety and Rescue — Executive Summary 
MSC-03975, LMSC-A984262A 

Lunar Mission Safety and Rescue - Technical S ummar y 
MSC-03976, LMSC-A984262B 

Lunar Mission Safety and Rescue - Hazards Analysis and 
Safety Requirements 
MSC-03977, LMSC-A984262C 

Lunar Mission Safety and Rescue Escape/Rescue Analysis and Plan 
MSC-02978, LMSC-A984262D 
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Glossary 

SJMBOLS, ABBREVIATIONS, AND DEFINITIONS 


Astronaut Maneuvering Unit (generic term) 

The time required to ready the rescue vehicle and crew 
for a rescue operation following receipt of the alert 
signal 

Portable Life Support System (PLSS) carried on the back 
of an astronaut (generic term) 

Lunar Surface Base (generic term) 

Two or more men working together in the same location and 
environment 

Crew Compartment used to house and transport men on the 
PTV and tug (generic term) 

The time required for the distressed crew to communicate 
a request to the rescue crew 

Chemically Powered Prime Transport Vehicle (generic term) 
Change in vehicle velocity in inertial space 


A general, unspecified location in Earth orbit or on Surface 

Environmental Control/Life Support System (generic term) 

Environmental Control System (generic term) 

Extravehicular Maneuvering Unit (generic term) 

Utilization of on-hand equipment and resources, without 
outside assistance, to effect immediate removal from the 
proximity of danger 

Emplaced Scientific Station (generic term) 

Propellant Depot (generic term) 

Generic term for any flying vehicle designed for limited 
travel over the lunar surface (LFV) 

Guidance and Navigation 

Presence of a potential risk situation caused by an unsafe 
condition, environment, or act 
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Lunar Lander Tug (generic term); space tug with landing 
gear 

Lunar Module 
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Lunar Roving Vehicle (Rover) 

Lunar Surface Base 

Lunar Scientific Survey Module 
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MOLAB Mobile Laboratory 

MPL Manned Payload 

N-PTV Nuclear-Powered Prime Transport Vehicle (generic term) 
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w Sp0r J V f? icle used to transport personnel and 
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Reaction Control System 


a t saf Shaven 0 ** ° UtSide assistance to effect a return to 
Roentgens equivalent man 


The span of time between the occurrence of 
and the placement of the stranded crew into 
or permanent safe haven 


an emergency 
a temporary 


Reusable Nuclear Shuttle (N-PTV) (generic term) 

Generic term for any lunar surface transport vehicle 
moving on tracks, wheels, etc. (LRV) 
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Secondary Life Support System (generic term) 


Refers to the utilization of resources 
hand to extend the lives of crewmen to 
or rescue 
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permit escape 
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SECTION 1 
INTRODUCTION 


This report presents the results of work performed by the Lockheed Missiles & 
Space Company for NASA-MSC , under the hazards analysis subtask of Contract 
NAS9- 10969, during the period June 15, 1970 to March 15, 1971. 

1.1 Objectives 

The objectives of the hazards analysis portion of the Lunar Mission Safety and 
Rescue Study were to: 

1. Identify potential hazards in lunar orbital and surface operations, crew 
activities, functions, and environments. 

2. Determine, the effects of the identified hazards on crew safety. 

3. Develop corrective measures for the identified hazards, including hazard 
detection and preventive and remedial concepts. 

4. Identify hazardous situations wherein rescue might be required. 

5. Establish essential guidelines and requirements for risk reduction in ad- 
vanced manned lunar exploration. 

6. Identify requirements for additional analyses and technology development 
pertinent to crew safety. 

1.2 Scope, Ground Rules, and Assumptions 

The study was limited to the lunar sphere of influence and to the 1980-1990 
time period. 

Lunar orbital activities were defined to commence at lunar orbit insertion and 
conclude either during spacecraft contact with the lunar surface or upon 
completion of the transearth maneuver. 
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Lunar surface activities were defined to commence with the final flight phase 
immediately preceding spacecraft touchdown on the lunar surface and to conclude 
once the crew had returned to a lunar ascent vehicle and ascent had begun. 

The design and routine internal operations of major lunar orbital elements such 
as the Tug, Nuclear Shuttle, and Orbiting Lunar Station were assumed to be op- 
timized and were not studied. Failure of the elements to accomplish their in- 
tended mission, and operational hazards between independent elements, were 
postulated or identified and analyzed. 

No probability analyses were performed during the study. Hazards were identi- 
fied and analyzed even though the probability of occurrence might be low. 

Current planning and definition of the Lunar Integrated Program Plan (IPP) was 
accepted as a baseline for the study and as a point of reference, but the analy- 
sis and results were kept general enough that the guidelines will be valid 
even though the IPP elements and operations change . Where terms such as Tug, 
Orbiting Lunar Station, and Lunar Surface Base are used, no specific concept, 
shape, size, capacity, or mass are implied, and only functions are indicated. 

The results of Apollo flights, in particular flights No. 11, 12, and 14, were 
used freely in the analysis. In addition, the results of current contracted 
studies relative to the Space Tug, Orbiting Lunar Station, Reusable Nuclear 
Shuttle, and complementary safety efforts were made available by NASA and were 
used. 

The study was concerned only with hazards to personnel and not with loss of 
equipment or property. 

1.3 Approach 

The approach to the Hazards Analysis subtask is illustrated in Fig. 1. Hazards 
characterization includes the definition of a hazard, the hazard levels, and 
the hazard groups. These are presented in Appendix A. The definition of a 
hazard and the hazard levels were taken from MSC^-1702, "System Safety Program 
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Requirements for Space Flight Contractors’ 1 . NASA-MSC Houston, Texas (not 
dated), while the hazard groups were derived as a part of the study effort. 

The mission model was based on the Lunar Integrated Program Plan (IPP) and 
Project Description Documents (PDD's) and represented a lunar exploration 
program for engineering development and scientific exploration in the 1980’s. 
The model was used as a point of departure throughout the study in the search 
for ways to enhance safety. Additional detail is presented in Appendix B. 

Typical lunar exploration equipment elements and their usage are illustrated 
in Fig. 2 and listed as follows: 

. Transportation between Earth Orbit and Lunar Orbit 
Nuclear Shuttle 
Chemical Shuttle (alternate) 

Lunar Lander Tug (emergency return) 

. Operations in Lunar Orbit 

Orbiting Lunar Station 

Lunar Lander Tug (normal and rescue) 

Propellant Depot 
Consumables Capsules 

Unmanned Satellites (scientific, communications, etc.) 

. Transportation between Lunar Orbit and Lunar Surface 
Lunar Lander Tug (normal and rescue) 

. Operations on the Lunar Surface 

Lunar Lander Tug (normal and rescue) 

Lunar Surface Base 

Roving Vehicles (normal and rescue) 

Flying Vehicles (normal and rescue) 

Science Equipment (emplaced stations, drills, telescopes, etc.) 
Support Equipment (elec, power, trailers, supply cannisters, etc.) 

Lunar mission operations examined in the study included the following. 
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Figure 2 Typical Lunar Exploration Equipment Elements 
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Earth-Moon 
Shuttle Operations 

Transport Payload 
Lunar Orbit Insertion 
Trans-Earth Injection 
Rendezvous & Docking 
Stati onke eping 
Contingency Operations 


Orbital Operations 

Rendezvous & Docking 

Operations Base 

Orbit Keeping & Transfer 

Resupply 

Maintenance 

Tug Refueling 

Technology & Engineering 

Science 

Extra Vehicular Activity 
Satellite Place & Service 
Escape/Rescue 
Contingency Operations 


Surface Operations 

Deployment 

Exploration 

Technology & Engineering 

Science 

Resupply 

Maintenance 

Walking 

Driving (Roving) 

Flying 

Escape/Rescue 
Contingency Operations 


The methodology developed to carry out the hazards analysis is presented in 
Appendix C. Working from study objectives and the mission model, the top-level 
functions and operations of lunar exploration elements were described. This 
was expanded in a first-level flow chart to identify potentially hazardous 
conditions and situations requiring study. The top-level and first-level 
hazards assessments are presented in Appendix D. 

Working from the first-level hazards assessment charts, and from knowledge of 
the planned future missions, a list of conditions and situations requiring 
further hazards analysis was compiled, and individual Hazard Study efforts 
carried out. From each Hazard Study the potential hazards were identified, 
effects described, corrective measures proposed, rescue requirements noted, 
and candidates for safety guidelines proposed. When the individual studies 
were complete, a study of safety guidelines candidates was made to assess com- 
patibility and feasibility, and to firm up the recommendations which appear 
in MSC 03976. 

Certain data generated to support the individual Hazard Studies, or to sug- 
gest approaches to improving safety, are presented in Appendix E as Supple- 
mental Data Reports. 

Symbols and abbreviations used in this report are defined in the Glossary. 
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Section 2 

HAZARDS ANALYSIS RESULTS 

The hazards analysis methodology is described in detail in Appendix C. This 
methodology was used to prepare the top level functional flow diagram, to per- 
form the first level hazards assessment presented in Appendix D, and to de- 
velop a list of conditions and situations requiring individual hazard studies. 
This section presents the individual Hazard Study results in total. Each 
Hazard Study is, in general, complete in itself and may be separated from 
the document for use by a reader interested only in a specific subject. The 
complete listing of Hazard Studies is presented in the Table of Contents. 

Following completion of the Hazard Studies presented here, an anlysis was 
performed to extract the significant hazards and the recommended guidelines 
and requirements to prevent or remedy those hazards. These hazards and 
guidelines are summarized in Section 2 of MSC 03976. 

The situations leading to a requirement for rescue sure identified in each 
Study. These were made available to the Escape/Rescue subtask effort wherein 
rescue requirements were developed in detail and escape/rescue guidelines and 
a rescue plan were prepared and documented in MSC 03978. 
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HAZARD STUDY 1 

PRIME TRANSPORT VEHICLE (PTV) IN AN UNCONTROLLED 
TRAJECTORY - FAILURE OF PTV TO ACHIEVE LOI 


INTRODUCTION 

This study considers the hazards to man resulting from a failure of a prime 

transport vehicle (PTV) to achieve Lunar Orbit Insertion (LOI). The PTV may 

be either chemical or nuclear powered. 

ASSUMPTIONS 

The following conditions are assumed for purposes of the analysis: 

Case 1. The PTV is transporting the first crew and Tug payload for the 

initial manning and activation of an orbiting lunar station (OLS). 
The crew is located in the crew module of a man-configured, fully 
loaded Tug vehicle. The Tug is provisioned for a nominal 28-day 
mission. 

Case 2. The PTV is transporting a replacement crew and resupply consumables 
to a currently manned and active OLS. The replacement crew is lo- 
cated in a crew compartment docked to several cargo containers 
which are in turn docked to the PTV. The crew compartment has no 
independent propulsion capability. 

The OLS is in a 60 nm circular orbit. 

Navigation update is provided from Earth base. 

The PTV configurations for the two conditions considered are as follows: 
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TUG-1 TUG-2 


CREW-1 f 



INITIAL MANNING CONFIGURATION 


O 

o 


CREW-P.f 


CARGO 




SUBSEQUENT MANNED MISSION CONFIGURATION 


Additional data for this study are presented in Appendix E, Supplemental 
Data Report No. 1. 

THE MAJOR HAZARDS 


The primary function failures which defeat the achievement of an LOI are as 
follows : 


a. Degradation or loss of vehicle navigation capability. 

b. Degradation or loss of vehicle orientation capability. 

c. Degradation or loss of primary propulsion capability. 

Of these three primary function failures, the degradation or loss of vehicle 
on capability is the least likely to prevent l>01, since navigation 
errors of that magnitude could scarcely elude the attention of Earth stations 
and the on-board crew. It is presumed that the crew would be provided with 
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the capability (and up-date information from Earth base) to manually direct 
the vehicle to the target position. Thus, this particular function failure 
would not be permitted to develop into a hazard generator. 

Regardless of which function failure triggers the inability to achieve lunar 
orbit insertion, the resultant hazardous situation generated for Cases 1 and 
2 is: 

Crew personnel are aboard a disabled PTV in an uncontrolled lunar escape 
trajectory. 

The potential major hazards to man evolving from this situation are as 
follows : 

(a) For Case 1 - First Crew Delivery: 

-1. Temporary stranding of crew aboard a disabled PTV. 

-2. Potential loss of crew if the disabled PTV failed with 
excessive rates/motions. 

(b) For Case 2 - Subsequent Crew Deliveries: 

-1. Potential loss of stranded crew on board disabled PTV. 

-2. Probable loss of stranded crew if disabled PTV has failed 
with excessive rates/motions. 

(c) For both cases the PTV may be on an Earth return trajectory. 
ANALYSIS OF IDENTIFIED HAZARDS 

The effects of the major hazards resulting from the inability of the PTV 
to accomplish an LOI maneuver are considered for two significant function 
failure modes : 

(a) For an assumed function failure causing loss of main propulsion 
capability but with attitude control capability intact. 

(b) For an assumed function failure causing loss of vehicle orientation 
capability. 
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Hazard Effects ; 

The loss of main propulsion capability disables the PTV and places the on- 
board crew in the hazardous situation of being temporarily stranded in a 
coasting vehicle on a lunar escape trajectory. 

The loss of vehicle orientation capability presents the same hazardous situa- 
tion except that the vehicle may have acquired a rate vector or motion in 
some axis other than the desired flight vector. The severity of the residual 
rate or motion could have serious effects upon the crew well-being and sur- 
vival capability and on escape/rescue. 

The fate of the PTV in either event ranges from potential heliocentric 
orbit insertion, or geocentric orbit insertion if the lunar approach velo- 
city is sufficiently low. It is also possible for the PTV trajectory to 
result in Earth impact, though analysis of this hazard is beyond the scope 
of this study. 

Corrective Measures 

PTV Delivery of First Manned Payload 

Preventive measures: 

The capability of the PTV to accommodate critical function failures via re- 
dundant systems employing a fail-operational approach is primarily a basic 
system and subsystem design problem. The capability of the PTV to continue 
critical operations in a contingency mode is judged to be of prime importance 
in its manned configuration. 

Remedial Measures : 

For the first crew delivery mission, and any subsequent manned PTV mission 


2-5 



LMSC-A984262C 


where a crew capsule configured Tug is a part of the payload, the crew has 
the option of employing the Tug as an escape vehicle for leaving the PTV. 

This presumes that the Tug is in a powered-up state at the time that an LOI 
is approached and further that the Tug can be rapidly disengaged from the 
PTV payload structure. 

The remedial measures requirements in this case are: 

a. Provision for power-up the Tug at any time in a PTV mission. 

b. Provision for Tug guidance update on a continuously available basis. 

c. Provision for emergency separation of Tug from PTV docking or pay- 
load structure. 

d. Provision of direct PTV/EDS alert and warning output for Tug flight 
control station. 

e. Provision of contingency LOI procedures for Tug emergency utilization. 

PTV Delivery of Subsequent Manned Payloads (Personnel and Cargo) - Case 2 

For all missions following the delivery of the first crew (excluding subse- 
quent Tug delivery missions), the transport mode employed for rotational 
crew delivery and return is the crew module. Basically, this unit is con- 
ceived to be a crew shelter cannister having a complete and self-contained 
life support system with facilities and provisions to maintain a crew during 
transit to and from the OLS. The module is dockable to other cargo modules 
and the OLS, and is moved about via a Tug to effect crew transfer operations. 
The most singular characteristic about the crew module is its complete lack 
of propulsion capability. The transport of personnel in this fashion trans- 
fers the responsibility for the safety of the passengers completely and 
irrevocably to the PTV and its operations. 
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Preventive Measures: 

(A) PTV Considerations : 

For the basic PTV, it will be necessary for the PTV to accommodate critical 
function failures through redundant systems and subsystems employing fail- 
operational criteria for stepping through available redundancies. Such pro- 
cedures coupled with contingency operational modes for operating with de- 
graded systems must be considered to be of prime importance. 

(B) Crew Module Considerations : 

In recognition of the fact that human efforts are fallible, it is prudent to 
insure that not only the systems on which man is dependent are close to 
failure free, but, that escape from disasterous consequences is possible in 
the event of a chance failure or accident. Therefore, in order to provide an 
adequate margin of safety for the survival and recovery of the crew-module 
it is deemed necessary to provide some minimal propulsion capability which 
would permit the crew and module to escape from a disabled or disabled and 
tumbling PTV and at least achieve an "await rescue" position in the vicinity 
of the PTV or even achieve an elliptical lunar orbit. The minimum propulsion 
capability required for the crew module to accomplish an elliptical lunar 
orbit insertion would be on the order of a 1000 fps A V. Data relative to 
the crew module escape from a tumbling nuclear PTV are presented in Appendix E, 
Supplemental Data Report No. 4. The module should have stabilization capa- 
bility sufficient to permit the module to present a stable target for docking 
to a rescue vehicle. On board systems would include emergency communications 
equipment, a power system, a rescue beacon, and ECS/LSS. The fate of a 
crew in a crew module must not be solely dependent upon the carrier vehicle 
under any circumstances. 

Remedial Measures : 

Since the OLS is manned for all subsequent PTV crew delivery missions, Tugs 
stationed at the OLS are available for rescue operations. However, the use of 
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the Tugs for rescue or retrieval operations must be considered in the light 
of program resource-depletion, and hence, consideration must be given to the 
time element allowable in each rescue or retrieval event. Realistically, 
situations involving crew health and well being will require first order 
priority at the expense of resource depletion. It is because of this un- 
predictable requirement that logistic operations should be planned in such a 
way that the impact of a non-catastrophic mishap does not result in a major 
expenditure of resources. Thus, if a crew-module should leave a disabled 
PTV (which could not make the LOl) and enter in an await-rescue orbit, the 
resources cost of the "rescue" would be far less than if the Tug had to 
chase the PTV, retrieve the module, and return to the OLS (rescue Tug AV 
of 4,400 ft/sec vs 14,000 ft/sec). The above notwithstanding, crew-module 
rescue, or even PTV capture and retrieval, appears to be quite feasible in 
view of the Tug capabilities. The following three alternate remedial meas- 
ures with respect to crew-module rescue are considered feasible: 

1. A rescue vehicle (Tug with aAV capability of about 14,000 ft/sec stand- 
ing by at the OLS is required to intercept the stranded crew and crew- 
module on a disabled PTV and return them to the OLS. 

2. A crew-module with an on-board 4V capability of 1000 ft/sec can leave 
the PTV and enter a lunar orbit. It then becomes possible for a rescue 
vehicle standing by at the OLS to recover the orbiting crew-module for 
a A V expenditure of only about 4400 fps. The weight for propulsion 
system plus propellant to provide a d V of 1000 ft/sec to a 10,000 lb 
crew compartment and 3,300 lb instrumentation unit is between 1500 and 
2000 lb, depending on propellants assumed. 

3. A crew-module with an on-board AV capability of 3000 ft/sec can leave 
the PTV, enter lunar orbit, and proceed to the OLS without need for 
rescue. Assuming that propulsion is added to provide a A V of 3,000 ft/sec 
to a 10,000 lb crew module and 3,300 lb instrumentation unit, the pro- 
pulsion weight penalty would be between 4,500 and 6,000 lb, depending 

on propellants assumed. 
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Escape/ Rescue Requirements 

For manned PTV missions with a Tug in the payload, escape capability for 
the crew utilizing the on-board Tug vehicle is a mandatory requirement. 
Emergency separation capability for the Tug under tumbling conditions is 
also required. 

For manned PTV missions with a crew module, but no Tug, escape from a tumb- 
ling or partially destroyed PTV, plus rescue from lunar escape trajectory 
are required. 

SOURCE DATA 

1. Nuclear Shuttle System Definition Study - Phase III, Monthly Progress 
Report, LMSC-A9S0259, Nov 15, 1970. 

2. Nuclear Stage, PDD, MSC. April 13, 1970. 

3. Equivalent Chemical Stage, PDD, Vol III, May 5, 1970. 

4. Chemical Propulsion Stage, PDD, MSC, July 1970 

5. IPP Reference Schedule - High Budget, MSC, May 5, 1970. 
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HAZARD STUDY 1 

SUMMARY OF SAFETY GUIDELINES 

1. The crew of a prime transport vehicle shall be provided with navigation 
update information, and with the capability to manually direct the vehicle 
to the target position. 

2. If the crew module of a prime transport vehicle (PTV) is mounted on a 
propulsion vehicle, such as a Tug, that Tug shall be in a powered-up 
state at the time of lunar orbit insertion or departure and shall be 
capable of rapid separation from the PTV to function as a crew escape 
vehicle. 

3- Nuclear prime transport vehicles shall not be placed on a free Earth 
return trajectory leading to reentry at Earth. 

4- During each manned prime transport vehicle arrival or departure at the 
the Moon, other operations in orbit and on the lunar surface shall be 
restricted to activities with low risk of generating a rescue require- 
ment. 

5. Crew modules, serving essentially as replacement-crew delivery shelters, 
shall be capable (as a minimum) of quickly separating and moving away 
from a disabled (stable or tumbling) prime transport vehicle. The crew 
module shall be capable of providing coarse attitude control, communica- 
tions (beacon and voice) and life support while awaiting rescue. 

6. During each manned prime transport vehicle (PTV) arrival and departure 
at the Moon a rescue vehicle, manned and ready, shall be on standby in 
lunar orbit to intercept a PTV that fails to achieve lunar orbit inser- 
tion or departure. This rescue vehicle, assumed starting from a 60 nm 
circular, coplanar orbit and returning to that orbit, shall have a mini- 
mum AV capability of 14 >000 ft/sec. 

The following two guidelines assume that the crew module is given a modest 
4V capability sufficient to place the crew into an elliptical lunar orbit, 

and are alternates to guideline No. 6, above. 
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7. The crew module shall have the capability to quickly separate from a dis- 
abled prime transport vehicle, provide a A V of 1,000 ft/sec to achieve 

an elliptical lunar orbit, and maintain attitude, communications, and life 
support while awaiting rescue. 

8. During each manned prime transport vehicle arrival and departure at the 
Moon a rescue vehicle, manned and ready, and with a AV capability of at 
least 4,400 ft/sec, shall be standing by in lunar orbit (assumed to be 
60 nm circular) . 

The following guideline assumes that the crew module is given a A V sufficient 
to allow the crew module to separate from the disabled prime transport ve- 
hicle and proceed to a safe haven in a 60 nm lunar orbit without assistance 
from a rescue vehicle. This guideline is an alternate to 6, 7, and 8 above. 

9. The crew module shall have the capability to quickly separate from a 
disabled prime transport vehicle and provide all necessary life support 
and communications functions while continuing on to a safe haven in 
lunar orbit, assumed to be at 60 nm circular. The minimum AV capa- 
bility shall be 3,000 ft/sec. 
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HAZARD STUDY 2 

PRIME TRANSPORT VEHICLE (PTV) IN AN UNCONTROLLED TRAJECTORY - 
FAILURE OF PTV TO ACHIEVE TEI 


INTRODUCTION 


This study considers the hazards to man resulting from a failure of a prime 
transport vehicle (PTV) to achieve Trans-Earth Insertion (TEI). The PTV 
may be either chemical or nuclear powered. 

DISCUSSION 

Analysis has shown that the hazards, corrective measures, and candidate 
safety guidelines for this failure are essentially identical to those pre- 
sented in Hazard Study 1 and Hazard Study 3. The PTV may still be in an 
orbit about the Moon, or may have achieved escape velocity at the time of 
the failure. Hazard Study 1 and 3 should be consulted for details. 
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HAZARD STUDY 3 

UNCOOPERATIVE OR DISABLED PRIME TRANSPORT VEHICLE IN LUNAR ORBIT 
INTRODUCTION 

This study area addresses the situation of a prime transport vehicle (PTV), 
manned or unmanned, which becomes uncooperative or disabled in lunar orbit. 
The source of propulsive power may be either chemical or nuclear. 

ASSUMPTIONS 

1. The PTV failure leaves that vehicle in some orbit, about the Moon, vary- 
ing from 60 x 60 nm to 60 x 11,800 nm. 

2. For initial manning of an orbiting lunar station the PTV crew will be 
located .in the crew module of a man-configured tug vehicle. 

3. For crew exchanges the men are located in a crew compartment which has 
no independent propulsion capability. 

Configurations for assumptions 2 and 3 are illustrated in Hazard Study 1 
which should be considered in concert with Hazard Study 3 . 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Potential collision between a disabled PTV and another orbital vehicle. 

2. Stranding of a crew aboard a disabled PTV. 

3. Potential loss of crew aboard a disabled PTV that has failed with exces- 
sive angular rates. 

4. Radiation hazard to other orbital vehicles if the PTV is nuclear powered. 
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ANALYSIS OF IDENTIFIED HAZARDS 
Effects of Hazard 1 , Potential Collision 

An uncooperative PTV in lunar orbit presents a potential collision hazard 
with other vehicles in orbit such as an orbiting lunar station, tug, or other 
PTV. 


The consequences of a collision of an OLS with a disabled PTV in the opera- 
tional orbit, where both vehicles have very closely the same orbital velocity, 
are not likely to be catastrophic in nature. However, damage to structures 
or appendages could result and the integrity of the PTV and OLS system could 
be violated. The potential effects to man may range over the following: 

a. Necessity for a potentially hazardous inspection and damage survey 
mission to ascertain future OLS and PTV usability and/or salvage 
potential. The mission would entail the capture (if possible) of the 
PTV and its removal to a safe parking orbit. 

b. Should the PTV be a nuclear vehicle which has suffered severe struc- 
tural d am age, a mission requirement will then exist for the remote 
capture of the wreckage for disposal purposes in order to remove the 
ultimate possibility of nuclear engine lunar impact. 

For the case of a disabled PTV in elliptical lunar orbit having a 60 nm pe- 
riapsis, collision with an OLS at the point of orbit coincidence would be of 
a catastrophic nature. The potential effects impacting later manned missions 
may range over the following: 

a. Injury or death to crewman involved. 

b. Necessity for a potentially hazardous inspection and survey mission 
to examine and possible deorbit large wreckage segments. 

c. If the PTV were a nuclear vehicle, the fate of the nuclear engine 
would have to be determined. If the engine were intact and orbiting, 
it would have to be remotely captured for deep space disposal. If 
the engine had impacted the lunar surface, the area of impact would 
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have to be identified for surface quarantine purposes. And finally, 
if the nuclear engine had disassembled as a result of the collision, 
it is probable that some portion of the debris would impact and the 
rest would remain in an indeterminant spectrum of orbits for varying 
lengths of time. This, of course, would lead to a somewhat random 
distribution of eventually impacting nuclear debris over a large 
portion of the lunar surface. 

Corrective Measures for Hazard 1 

Preventive measures: 

1. Prime transport vehicles should preferably not be brought into the same 
or an intersecting orbit with other operational elements such as an 
orbiting lunar station, but should always operate from a higher orbital 
altitude . 

Remedial measures: 

1. Each vehicle in lunar orbit should be constantly aware of other traffic, 
be made aware of any emergencies or malfunctions that could present a 
hazard, and have the ability to maneuver to avoid collision. 

2. Orbital tug vehicles should have the capability to capture and control 
a PTV in orbit in order to prevent collision. 

3. If a collision is permitted to occur, rescue and medical aid will be 
urgently required . 

Collision is discussed further in Hazard Study 11. 

Escape /Rescue Requirements for Hazard 1 

Rescue may be required to remove the crew of a disabled PTV from the threat 

of collision. 
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Effects of Hazard 2 . Stranding of PTV Crew in Orbit 

The crew of a prime transport that has failed in lunar orbit will be stranded 
and in need of outside assistance unless the crew module is self sufficient. 
On initial manning of an orbiting lunar station it is anticipated that the 
crew module will be attached to a tug which can be separated and used to pro- 
ceed to the OLS unassisted. 

Corrective Measures for Hazard 2 


Preventive measures: 

1. Stranding of a PTV crew in lunar orbit may be prevented by providing each 
PTV crew capsule with the capability to separate and proceed to the OLS. 
This would require attitude control and navigation capability plus a pro- 
pulsive AV capability of about 2000 ft/sec. 

Remedial measures: 

1. A PTV crew stranded in lunar orbit must be provided outside assistance 
to remove them from the disabled vehicle and transport them to a safe 
haven such as an orbiting lunar station. 

Escape/Rescue Requirements for Hazard 2 

Rescue will be required if a PTV crew is stranded in lunar orbit. 

Effects of Hazard 3 > Tumbling PTV 

A tumbling PTV will present a considerable hazard both to the on-board crew 
and to any subsequent rescue attempt. If tumbling rates are low, the crew 
may not suffer greatly but cannot easily be rescued. If tumbling rates are 
high, rescue may be rendered impossible and death occur if capability for 
escape and survival is not provided. 
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Corrective Measures for Hazard 3 


Preventive measures: 

No measures to prevent a prime transport vehicle from tumbling are identified 
beyond careful attention to reliability and redundancy in the associated sub- 
systems, and fail-safe provisions to prevent excessive angular rates. 

Remedial measures: 

1. The crew of a prime transport vehicle should be able to assume manual 
control of vehicle attitude in order to avoid or stop tumbling. 

2. Means must be provided for the crew compartment on a tumbling PTV to 
separate, stabilize, and support the crew while proceeding to a safe 
haven, such as an orbiting lunar station, or awaiting rescue. 

Escape/Rescue Requirements for Hazard 3 

Means must be provided for the crew of a tumbling PTV in lunar orbit to 
escape and survive until rescue is accomplished. Rescue of the escaped 
crew will be required. 

Effects of Hazard 4 . Nuclear Radiation from Failed PTV 

A nuclear PTV, failed in lunar orbit, presents a potential radiation hazard 
to the crew attempting to escape, to rescue crewmen, and to crews of other 
vehicles in orbit. The crew of a tumbling nuclear vehicle will almost cer- 
tainly be required to escape without outside assistance , and must be able to 
depart the PTV quickly enough to avoid radiation damage. Appendix E, Supple- 
mental Data Report No. 4» discusses velocity requirements when leaving a 
tumbling nuclear PTV and shows that propulsive capability on-board the de- 
parting manned payload will be required. 
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Corrective Measures for Hazard 4 

Preventive measures: 

1, Nuclear vehicles should not be brought into the same or intersecting 
orbits with other operational elements such as an orbiting lunar station, 
but should always operate at a higher altitude, 

2. Rescue crews should not approach a tumbling nuclear powered vehicle 

unless adequate radiation shielding can be provided. 

Remedial measures: 

1. Crew modules, serving essentially as replacement-crew delivery shelters, 
should be provided the capability (as a minimum) to quickly separate and 
move away from a disabled (stable or tumbling) prime transport vehicle. 
The crew* module should further be capable of providing coarse attitude 
control, communications , (beacon and voice) and life support while await- 
ing rescue or proceeding to a safe haven* The minimum A V required is 
about 100 ft/sec with a minimum propulsive acceleration of 0.1 Earth g. 

2. An uncooperative nuclear PTV in lunar orbit must be captured and repaired 
or disposed of by placing it in a safe lunar orbit, return to Earth 
orbit, or injection to heliocentric orbit. Means for capture of a tumb- 
ling nuclear vehicle by another unmanned vehicle must be devised. The 
space tug should be developed to have this capability. 

Escape/Rescue Requirements for Hazard 4 

The crew of a disabled nuclear powered prime transport vehicle in lunar orbit 

must be able to escape that vehicle and survive, and a subsequent rescue will 

be required. The disabled PTV may be either stable or tumbling. 
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DATA SOURCE REFERENCES 


1. Nuclear Stage Program Definition Document, MSC, 9 Oct 1970 

2. Equivalent Chemical Stage, Vol III (of) Nuclear Stage Program Definition 
Document, MSC, 5 May 1970 

3. Chemical Propulsion Stage Program Definition Document, MSC, July 1970 

4. IPP Reference Schedule - High Budget, MSC, 5 May 1970 
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HAZARD STUDY 3 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. Prime transport vehicles, whether chemical or nuclear powered, shall not 
be brought into the same or intersecting orbit with other operational 
elements such as an orbiting lunar station, and shall always operate from 
a higher orbital altitude. 

2. Each manned vehicle in lunar orbit shall be constantly monitoring other 
traffic, emergencies, or malfunctions that could present a hazard and 
shall have the ability to maneuver to avoid collision. 

3. Orbital tug vehicles shall have the capability to capture and control or 
dispose of any prime transport vehicle in lunar orbit. The PTV may be 
chemical or nuclear, stable or tumbling. 

4. Crew modules, serving essentially as replacement-crew delivery shelters, 
shall be- provided the capability (as a minimum) to quickly separate and 
move away from a disabled (stable or tumbling, nuclear or chemical) prime 
transport vehicle. The crew module shall further be capable of providing 
coarse attitude control, communications, (beacon and voice) and life 
support while awaiting rescue or proceeding to a safe haven. The minimum 
propulsive requirement is about 100 ft/sec with acceleration of 0.1 
Earth g. A AV of about 2000 ft/sec would permit the crew to proceed to 
an orbiting lunar station without rescue assistance. 

5. Rescue crewmen shall not approach a tumbling nuclear vehicle unless adequate 
radiation shielding can be provided. 

6 . Any uncooperative prime transport vehicle in lunar orbit must be captured 
and either repaired or disposed of by placing it in a safe lunar orbit, 
returning it to Earth orbit, or injection to heliocentric orbit. 

The crew of a prime transport vehicle shall be able to assume manual control 
of vehicle attitude in order to avoid or stop tumbling. 
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HAZARD STUDY k 

ORBITING LUNAR STATION NOT FUNCTIONALLY OPERABLE/HABITABLE 
INTRODUCTION 

This study analyzes hazards associated with an orbiting lunar station (OLS) 

that becomes functionally inoperable or uninhabitable either before or at 

the time of initial manning, or while manned. 

ASSUMPTIONS 

1 . An orbiting lunar station (OLS) has previously been stationed in lunar 
orbit unmanned. 

2. One or more fully operable lunar lander tugs are docked at the OLS when 
men are entering or occupying the OLS. 

3. The internal design, functions, and safety of the OLS are the concern of 
other studies and not examined here. 

4. Crew compartments are provided with contaminant detection and removal 
equipment . 

5. All critical life support system components are highly reliable and 
have redundant parts. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1 . Insufficient time to don space suits or escape to adjacent, safe crew 
compartment following sudden loss of cabin atmosphere. It is assumed 
this could happen only following a meteoroid strike, collision, or 
explosion that ruptured the cabin pressure shell, or a fire. 

2. Inadequate backup or emergency power and life support supply to allow 
time for subsystem repair, transfer to a nearby safe haven, or to await 
arrival of rescue assistance. 


2-21 


LMSC-A984262C 


3. Illness or incapacitation or deprivation of oxygen following contamina- 
tion of cabin atmosphere. 

4. Injury and/or deprivation of life support following explosion or fire 
with an internal system such as a high-pressure gas storage vessel, 
pyrotechnic, or experimental device. 

5. High angular rate following loss of the primary and backup station 
attitude stabilization systems. 

AN ALY SIS OF IDENTIFIED HAZARDS 

To prevent an abnor mal condition from becoming a threat at the time of 
initial mannin g the following measures should be taken. 

Preventive measures: 

1 . Remote activation and checkout of the OLS prior to initial manning so 
that deficiencies or problems will be known and can be planned for in 
advance . 

2. Provision of pressure suits and FLSS units, repair parts and tools, 
portable battery powered lights, and specific procedures for inspecting 
and repairing an inoperative OLS on initial manning. 

Remedial measures for initial manning are not applicable. 

The following descriptions apply to effects and corrective measures for 
failures occurring subsequent to initial manning of the OLS. 

Effects of Hazard 1 . Insufficient Time to Don Suits or Escape 

Insufficient time to don pressure suits or escape to an adjacent, safe com- 
partment following sudden loss of cabin pressure will result in loss of the 
crew. 
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Corrective Measures for Hazard 1 
Preventive measures: 

1 . Escape to a separate pressurized compartment could normally be accom- 
plished much more quickly than donning of a pressure suit. Action must 
be accomplished before cabin pressure drops to 1 .7 psia (Ref. 1 ) . Thus 
it is advisable to have multiple pressurized compartments available, 
with interconnecting passageway or airlock hatches open at all times but 
quickly sealable. The tug crew compartment, propulsion module, and 
instrument unit, assumed always present and docked to the OLS, is the 
preferred haven since this provides a complete support and communication 
system capable of separating from the OLS if necessary for safety. The 
compartment selected must have the capability to provide a safe haven 
for all crew members present until one of the following can be accom- 
plished. 

a. The station failure can be corrected 

b. External assistance can be provided 

c. The crew compartment(s) can be removed to a permanent safe haven 
No remedial measures are identified for Hazard 1 . 

Escape/Rescue Requirements for Hazard 1 

Rescue may be required if the station cannot be repaired by the threatened 
crewmen, or the tug has insufficient capability to transport the crew to a 
permanent safe haven. 

Effects of Hazard 2 . Inadequate Power and Life Support 

Inadequate backup or emergency power and life support supply to allow time 
for subsystem repair, transfer to a nearby safe haven, or to await arrival 
of rescue assistance will result in loss of the crew following failure of a 
vital station subsystem. 
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Corrective Measures for Hazard 2 

Preventive measures : 

1 . Each mission sequence must be planned such that a backup or emergency 
source of power, life support, and communication capability will be 
available at all times so that following loss of a primary source the 
crew can proceed to a safe haven unassisted or await rescue, whichever 
time is greater. 

No remedial measures are identified for Hazard 2. 

Escape/Rescue Requirements for Hazard 2 

Rescue of a crew in lunar orbit with inadequate power and life support 

supplies may be required. 

Effects of Hazard 3 . Illness or Incapacitation Following Contamination 

Contamination of cabin atmosphere will result in illness, incapacitation, 

or deprivation of oxygen if corrective action is not taken. 

Corrective Measures for Hazard 3 

Preventive measures: 

1. Provision of oxygen mask, emergency pressure garments and/or pressure 
suits, or separate pressure compartment and ECS, and immediate use of 
one of these, following detection of contaminants. 

2. Monitoring of cabin atmosphere to detect contamination and initiate 
corrective action before illness, incapacitation, or oxygen deprivation 
can occur. 
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Remedial measures: 

1 . Outside assistance, or temporary abandonment of the station may be re- 
quired if contamination cannot be removed. 

2. Crewmen suffering from breathing contaminated atmosphere must be pro- 
vided clean air, a safe haven, and medical aid. 

Escape/Rescue Requirements for Hazard 3 

Rescue will be required if corrective measures are not taken to prevent 

illness or incapacitation from contamination. 

Effects of Hazard 4. Injury or Deprivation of Life Support Following Fire or 

Explosion 

An explosion or fire may have hazardous effects similar to Hazards 1 and 

3. already discussed, and additionally cause injury to one or more crewmen. 

Corrective Measures for Hazard 4 

Preventive measures for Hazard 4 include those discussed for Hazards 1 and 

3, plus the following: 

1. High-pressure gas storage bottles, pyrotechnics, and hazardous 
experimental devices should be separated from the main cabin 
and from vital subsystems components by structures designed to 
help control an explosion or fire. 

2. Pressures in high-pressure storage vessels should be monitored 
to provide explosion warning, and procedures developed to cor- 
rect potential hazards. 

3. Where multiple pressure compartments are provided in a system, 
crew members should not all occupy one compartment at one time. 
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4. Provision should be made in station design for sealing each 
pressurized compartment separately, and then remotely exhaus- 
ting the atmosphere to extinguish a fire. (See note Page 2 - 26 ) 

5 . Fire extinguishers should be provided in each pressurized 
compartment. 

Remedial Measures: 

1 . Crewmen injured by explosion or fire will require immediate 

medical assistance, provision of pure atmosphere, and removal 
to a safe haven. 

Escape/Rescue Requirements for Hazard 4 

A crewman injured by fire or explosion must escape to be rescued and provided 
a safe haven and medical aid. Removal to Earth may be necessary for adequate 
treatment. 

Effects of Hazard High Angular Rate 

A rotating station in orbit could pose a hazard to crewmen ranging from neg- 
ligible to catastrophic, depending on rotational rate, direction of acceler- 
ation, and duration. Prolonged rotation at rates on the order of 300 degrees/ 
second will lead to unconsciousness and eventually death. 

Corrective Measures for Hazard 5 
Preventive Measures: 

1 . Attitude control thrusters should be designed to fail "off" to prevent 
excessive angular rates. Do not design systems with hot coils that are 
grounded in order to fire. 

2. Backup attitude stabilization systems should be provided to arrest 
tumbling, should it occur, to allow repair or capture by an assisting 
vehicle. Means should be provided to detect and isolate a failed engine. 

3. Space tugs docked to an orbiting lunar station should be capable of 
providing emergency attitude stabilization for the entire system, 
assuming the OLS attitude control system is inactive. 
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Remedial measures: 

1 . If preventive measures are not taken, provision must be made for crewmen 
to escape from a rotating orbital station. 

2. It is recommended that study of methods for arresting tumbling of 
space vehicles by outside means be accomplished. 

Escape/Rescue Requirements for Hazard 5 

If preventive measures are not taken, escape and rescue will be required. 

Data Source References : 

1 . "Analysis of the Required Operational Characteristics of Space Escape 
Systems," Vol. III,J. E. Moeller, et al. N.A.R. Nov 1967, SAMSO-TR-67-7 

2. "Fire Extinguishment in hyperbaric and Rypobaric Environments." 

J. Howard Kimzey, NASA Manned Spacecraft Center, presented to the NASA 
Conference on Materials for Fire Safety, Houston, Texas, May 6-7, 1970 

NOTE : 

Following the completion of the technical study effort, the advis- 
ability and effectiveness of evacuating a cabin atmosphere to 
extinguish fire was questioned. Tests discussed in Reference (2) 
have shown that in an open— celled polyurethane— foam fuel in pure 
oxygen (5 to 16.2 psia) , the cells trapped oxygen and the ignited 
fuel continued to bum until the pressure was dropped to 0.12 psia 
in two minutes. 

It is recommended that further testing be carried out in mixed gas 
and in pure oxygen a bno spheres with materials now considered accept- 
able for use in space cabins. 

Reference (2) also describes the test of a high-expansion, breath- 
able, foam extinguishing agent composed of approximately 300 parts 
gaseous oxygen (the ambient gas in the test chamber) to one part of 
water-based solution. This agent was found to be quite effective 
and to show promise for future applications. 


2-26 


(This page left blank intentionally.) 


2 - 26 (a) 



LMSC-A984262C 


HAZARD STUDY ^ 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1 . Provision shall be made to remotely activate and checkout an orbiting 
lunar station which has been taken to lunar orbit by an unm an ned trans- 
port vehicle. 

2. A crew sent to activate a defective unmanned orbiting lunar station 
shall be provided with pressure suits and PLSS units, repair parts and 
tools, portable battery powered lights, and specific procedures for in- 
spection and repair. 

3. Development of safe and effective means for arresting the rotation of a 
tumbling station in orbit ty outside means shall be a prime requirement. 

4. Each orbiting lunar station shall have more than one pressurized com- 
partment capable of supporting the crew. Hatches to interconnecting 
passageways or airlocks shall be kept open at all times, but quickly 
sealable in an emergency. 

5. Each orbiting lunar station shall have docked to it, and immediately 
accessible, space tug vehicles with crew compartments, propulsion 
modules, and instrument units capable of housing and supporting the 
entire remaining station crew. 

6. Each orbiting lunar station mission sequence shall be planned such that 
a backup or emergency source of power, life support, and communication 
capability is available at all times so that following loss of a primary 
source the crew can proceed to a safe haven unassisted or await rescue, 
whichever time is greater. 

7. Cabin atmosphere in an orbiting lunar station shall be monitored at 
all times to detect contaminants such as solid particles, excessive 
CO 2 , vaporized chemicals, and permit correction action to be taken 
before illness, incapacitation, or oxygen deprivation can occur. 

8. Each orbiting lunar station shall provide oxygen masks and emergency 
pressure garments at each crew station, pressure suits and PLSS units 
for each crew member, and immediate use of these or escape to a separate 
compartment following explosion, fire, loss of pressure, or detection 

of contaminants in the atmosphere. 
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9. High -pressure gas storage "bottles, pyrotechnics, and hazardous exper- 
imental devices shall he separated from the main cabin of an orbiting 
lunar station and from initial subsystems components by enclosing in 
compartments vented to space and in structures designed to help control 
an explosion of fire. 

10. Pressures in high-pressure storage vessels shall be monitored to pro- 
vide warning of an impending explosion, and procedures shall be devel- 
oped to correct potential hazards so detected. 

11. Where multiple pressure compartments are provided in a system, crew 
members shall not all occupy one compartment at one time. 

12. Provision shall be made in orbiting lunar station design for quickly 
sealing each pressurized compartment separately, and then remotely 
exhausting the atmosphere to extinguish a fire. (See note Page 2-26) 

13. Fire extinguishers shall be provided in each pressurized compartment 
of manned vehicles. 

Ik. Attitude control thrusters and electronics for space vehicles shall 
be designed to fail "off" to prevent excessive angular rates from 
deve loping . 

15. Space vehicles shall be provided with backup or emergency attitude 
stabilization system to arrest tumbling and allow repair or capture 
by an assisting vehicle. 

16. Space tug vehicles docked to an orbiting lunar station shall be capa- 
ble of providing emergency attitude stabilization for the entire system. 
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HAZARD STUDY 5 

ASSEMBLY OF ORBITING LUNAR STATION ELEMENTS IN LUNAR ORBIT 
INTRODUCTION AND DISCUSSION 

In the event that a capability to transport a fully assembled orbiting 
station to lunar orbit is not developed, assembly of station modules in 
lunar orbit will be required. It is believed that such orbital assembly 
will consist of docking and coupling of modules, aided by manned space tugs 
in a manner little different from normal operations with tugs, crew com- 
partments, cargo modules, and propellant modules. Major appendages such 
as solar arrays, antennae, and scientific experiment booms will be cfe ployed 
by mechanical means not requiring EVA. 

No major hazards unique to orbital assembly of an orbiting lunar station 
are foreseen for the conditions described above. 


SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1 . Orbital assembly, if required, shall be planned to use normal docking 
and coupling procedures and devices developed for operational use with 

tugs, crew compartments, cargo modules and propellant modules. 

2. Major appendages for an orbiting lunar station, including solar 

arrays, antennae, scientific experiment booms, and other, shall be 
deployed by means not requiring EVA. 
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HAZARD STUDY 6 

CREW INGRESS/EGRESS FOR SPACECRAFT IN LUNAR ORBIT 


INTRODUCTION 

This study is concerned with crew ingress/egress for all spacecraft in lunar 
orbit and for crew members in a shirtsleeve or a spacesuit mode. However, the 
actual EVA mode of operations by any crew member is reserved for discussion 
in Hazard Study J. Dysbarism is discussed in Hazard Study 39 . 

In the course of events in lunar orbit, crew members will accompli sh various 
transfers between spacecraft; such transfers will include movement between: 

1. The lunar space station and various tugs 

2. The crew module leaving or arriving on a PTV and the lunar station 

3. One tug and another 

4- The lunar space station and any of its docked cargo or experiment modules 
ASSUMPTIONS 

1 . All crew members engaged in planned EVA will do so through the use of an 
airlock. 

2. Airlocks are constructed with equipment to supply environmental control 
either through a space suit loop or to a crew member in shirtsleeves. 

3. Each airlock will accommodate a minimum of two crew members. 

4. Ingress/egress hatches are designed to be jam-proof, quick opening, and 
to open in a direction judged optimum for safety for the specific con- 
figurations. 

MAJOR HAZARDS 

1. Crew member(s) are isolated outside of an airlock, by virtue of a mal- 
functioning hatch, while in a space suit and returning from EVA operations . 
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2. A crew member is unable to leave the spacecraft through an airlock 
when required for his own safety. 

3. A crew member in a shirtsleeve mode is 'trapped' in an airlock. 

ANALYSIS OF THE IDENTIFIED HAZARDS 

Effects of Hazard 1 . EVA Astronaut Isolated outside Spacecraft 

1. Since the astronaut (s) are in the process of returning from EVA their 
consumables will be largely depleted, therefore, they face the threat 
of asphyxiation unless oxygen can be gotten to them. Temperature con- 
trol mechanisms and power are also nearly depleted so that the qualities 
of environmental control in toto deteriorate as spacecraft entry is 
prolonged. 

Corrective Measures for Hazard 1 

Preventive measures: 

1. Provision should be made for supplying all of the necessities for en- 
vironmental control by plug-ins outside of the airlock including 
oxygen supplies, temperature control, power, humidity control, and con- 
taminant control. Communications facilities should be supplied also. 

The astronauts should have the option of controlling these supplies 
themselves in addition to such control as may be exerted by the space- 
craft crew. These supplies should be tapped from the spacecraft's main 
ECS to cover the case of a prolonged stay outside. It is recognized 
that the additional outlets represent potential leak paths. 

2. A second airlock should be available on the orbiting lunar station for 
use by crews deployed in EVA operations. 

3. It is suggested that the outer hatch be kept open while a crew member 
is on EVA. 
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Remedial measures: 

1. Provide outside assistance to open the malfunctioning hatch or rescue 
the isolated crewman. The hatch should be operable from either side. 

Escape /Rescue Requirements for Hazard 1 

1. The astronauts must be aided in getting into their spacecraft through 
the malfunctioned hatch or be rescued by another vehicle. The outer 
hatch may be forced from the inside by a suited crew member. 

2. If assistance is not available, the astronauts will have to get to 
another airlock or to a different spacecraft. 

Effects of Hazard 2 . Astronaut tapped in Spacecraft 

1. Because emergency EVA is postponed the crew member's life is endangered 
by some undefined condition on the spacecraft. 

2. If a crewman is attempting to transfer from a spacecraft for rescue 
operations then such rescue is endangered. 

Corrective Measures for Hazard 2 


Preventive measures: 

1. It is recommended that the lunar space station have a minimum of two 
airlocks in order that members of its crew may have alternate paths to 
leave the spacecraft. 

2. It is also suggested that space tug design be examined to ascertain the 
desirability, as well as the cost in volume and weight, of having two 
airlocks for crew use during tug activities. 
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Remedial Measures: 

1. Provide equipment and procedures for forced exit as a part of the space- 
craft or station design. 

Effects of Hazard 3 . Astronaut Trapped in Airlock 

1. A crewman working in shirtsleeves in an airlock will be endangered 
should the inner hatch fail to open. Life support supplies in the 
airlock may be limited, and access from outside cannot be gained with- 
out evacuating the airlock. 

Corrective Measures for Hazard 3 

Preventive measures : 

1. Provision should be made for supplying all of the necessities for en- 
vironmental control within the airlock including oxygen, power, temp- 
erature and humidity control, and cont aminan t control. A communications 
loop will also be required. The crew in the airlock should have the 
option of controlling their immediate needs. ECS supplies should be 
gotten from the spacecraft’s main ECS to cover the case of a prolonged 
stay in the airlock. All airlock hatches are expected to be open when 
crew members in a shirtsleeve mode are moving between a pair of docked 
spacecraft. Such hatches are all kept open until transfer has been 
completed. 

2. It is suggested that crew members in a shirtsleeve mode do not engage 
in airlock activity that requires working with the inner hatch closed. 

3. If a crew member must work in an airlock with both inner and outer 
hatches closed it is suggested that pressure suit and PLSS be available 
in case EVA exit is required. 

Remedial measures : 

1. Provide equipment and procedures for forced opening of an inner hatch 
from either side. 
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2. Provide rescue through the outer hatch to a docked, shirtsleeve environ- 
ment, vehicle. 

Escape/Rescue Requirements for Hazard 3 

With assistance: The 'trapped crew members will have to be rescued 

through the efforts of other members of their crew or 
another spacecraft will have to be used in a rescue. 

Without assistance: The 'trapped' crew will have to force the hatch to 

"escape" to the main cabin. 

Further Recommendations 


It is recommended that studies be conducted to determine the necessary 
numbers of airlocks for each of the spacecraft and vehicles in the entire 
lunar complex. 
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HAZARD STUDY 6 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. Each orbiting lunar station shall have a minimum of two airlocks to 
use for EVA purposes. 

2. An outer hatch shall remain open on an orbiting lunar station while 
crewmen are on EVA. 

3. Design of hatches shall include provision for forced opening from 
either side. 

4. The ECS operations for airlocks shall be supported by the spacecraft's 
main ECS and have emergency separate environmental controls as well. 
Each airlock should have self-contained regulatory controls both for 
ECS supplied from the main cabin supply and for airlock emergency ECS. 

5. Crew members in shirtsleeves should not carry on airlock activities 

with the inner hatch closed. If unavoidable, then pressure suits and 
PISS ' s should be available in the airlock. 

6. All airlocks shall be connected to the spacecraft communications loop. 
Moreover, it should be possible to contact other members of the lunar 
complex using airlock communications. 
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HAZARD STUDY T 

ORBITAL EXTRA VEHICULAR ACTIVITY (EVA) 


INTRODUCTION 

Commensurate with missions of long duration and the choice of hardware with 
inherent high reliability, characterized by either designed-in multiple re- 
dundancy or selection of components with very long mean-time-before-failure 
MTBF, strong implications of high cost exist. Alternatively, to obviate the 
high cost but still retain high reliability the use of man in the main- 
tenance/repair loop should be instituted. As the mission lifetime increases 
without end, as in the OLS- lunar base, the use of man in this maintenance/ 
repair cycle becomes mandatory. 

Tasks will occur for long-lived spacecraft that require the presence of man 
outside the spacecraft. Because the OLS lifetime will be measured in years, 
it is reasonable to expect a variety of EVA for purposes of meteoroid 
puncture repair, replacement of RGS thrusters and for general inspection and 
preventive maintenance activity in order to assure the crew of the general 
integrity of their spacecraft during the time the lunar space station orbits 
the Moon. This activity implies innumerable extravehicular engineering 
tasks throughout the OLS-lunar base program. Manned ’locomotion', maneuvering, 
materiel handling, maintenance and repair, alignment, and assembly-aid con- 
stitute integral parts of the EVA tasks. It is reasonable to state that 
without the aid of EVA the OLS-lunar base program would become much more 
complex and therefore more expensive and less reliable. 

ASSUMPTIONS 

1 . EVA will be required in the OLS-lunar base program. 

2. EVA typical tasks are: 

a. Replacement of the RCS nozzles on the OLS 

b. Performing maintenance on antennas 
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c. Repairing meteoroid damage externally (separate from whatever is 
repaired internally) 

d. Replacing sections of the environmental control system radiators 

e. Servicing unmanned lunar satellites under the jurisdiction of the 
OLS 

f. Performing some assembly and disassembly functions at the propellant 
farm in lunar orbit 

g. Obtaining close-up photographs of external damage or other phenomena 
which have an impact on the operation/integrity of the OLS 

3. Methods of providing ECS and communications will not include using long 
umbilicals if the EVA crew member is away from the OLS. 

4. If EVA is required for some task on the external surface of the OLS then 
the crew member will have three options: 

a. Connecting a short umbilical to an external plug built into the 
station surface, or 

b. Using a PLSS 

c. Using a cherry-picker like device (described later in this discussion) 
which obviates the need for a PLSS or a long, free-floating umbilical. 

THE MAJOR HAZARDS 

1 . Malfunction of oxygen supply. 

2. Communications malfunction. 

3. AMU malfunction leading to loss of attitude control. 

4. Overburn of propulsion unit leading to stranded astronaut and/or excess 
AY separating astronaut from vicinity of OLS or heading him into a 
collision with OLS or other spacecraft in vicinity. 

5. Illness while in EVA mode leading to vomiting, etc. 

6. Loss of electrical power. 

7. Exposure to excessive radiation. 
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ANALYSIS OF THE IDENTIFIED HAZARDS 
Effects of Hazard 1 . Oxygen Supply Loss 

It is conceivable that the crew member operating in an EVA mode may be so 
interested in his task that he neglects to monitor his oxygen supply and 
runs out of oxygen. Alternately, his oxygen supply may malfunction through 
hardware failure. This failure may be internal - a component failure, or 
external - failure due to meteoroid strike. 

Lack of oxygen for ^ 20 seconds results in loss of consciousness, and lack 
of oxygen for 3 minutes results in irreparable damage, and 5 minutes denial 
results in death. 

Corrective Measures for Hazard 1 

In addition to his normal oxygen supply the astronaut should have an emer- 
gency, 30 minute, independent supply. Initiation of use of that supply 
should set off an alarm both at the astronaut and on the display board by 
which he is monitored, and makes return to the cabin of his spacecraft (tug, 
OLS, etc . ) mandatory and immediate . 

If the EVA is on the external surface of a spacecraft, particularly the OLS, 
then a relatively short umbilical from the astronaut should be plugged into 
an external plug on the spacecraft surface for an oxygen supply. 

Escape/Rescue Requirements for Hazard 1 

If the emergency oxygen supply suffices for return to a safe haven then no 
requirements for rescue exist. The astronaut has escaped from his dangerous 
situation. If for some reason his emergency oxygen is insufficient to 
permit safe return then rescue must be initiated at once. Thirdly, one 
astronaut should be able to plug into the ECS of a co-working ’partner* who 
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is in an EVA mode or vice-versa. The latter situation should make return 
to a spacecraft cabin mandatory and immediate. ECS plugs should be available 
on the surface of every spacecraft used by man so that an astronaut in EVA 
could plug into such systems using a short umbilical; from this position 
he should be safe until rescue is completed. 

Effects of Hazard 2 . Communications Malfunction 

By equipment failure, tjy meteoroid strike or by loss of electrical power a 
communication malfunction and loss can occur. Equipment failure means the 
failure of any of the hardware in the communications subsystem which imme- 
diately leads to loss of communications. 

Loss of communications leads to a lack of information exchange between EVA 
astronaut and the spacecraft from which he is operating. The information 
includes both voice communication and monitoring of the vital signs (life 
functions) of the astronaut, thus knowledge about astronaut well-being is 
not constantly available. 

Corrective Measures for Hazard 2 

Communications loss leads to mandatory and immediate return to spacecraft 
for EVA astronaut. Circuit failure, either voice or monitoring, should set 
off alarm for EVA astronaut, and alarm operation should be independent of 
communications circuit operation. Communications for an EVA astronaut 
should be an essentially continuous activity while he is outside the space- 
craft. At the very least a communications check should be made every 
5 minutes. 

Escape/Rescue Requirements for Hazard 2 

Primary measure is for EVA astronaut and monitoring spacecraft to recognize 
lack of communications and to get a signal to the astronaut to tell him to 
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return to his spacecraft immediately. Such a signal could include the use 
of flashing beacon aimed at his helmet or a tug on his umbilical if he is 
attached to the spacecraft. If astronaut's alarm does not work then another 
astronaut is required to go out and get the crew member whose system has 
failed. 

Effects of Hazard 3. AMU Malfunction 

Failure of an attitude control thruster to stop firing when all other 
thrusters have stopped or, incorrect, unbalanced thrusting will lead to 
loss of attitude control. Loss of attitude control leads to uncontrolled 
tumbling of the astronaut, disorientation, nausea and illness (vomiting) . 
Illness, nausea and vomiting will not be dealt with here, they are discussed 
in Hazard Study . 35* Prolonged tumbling at rates of 300 degrees/sec and 

will lead to unconsciousness and eventually death. 

Corrective Measures for Hazard 3 

The astronaut should have a method of shutting down any 'runaway' thruster 
prior to reaching dangerous rate limits. He should have control of each 
thruster separately or any combination in concert to null out all tumbling. 
Attitude control thrusters should be disabled whenever EVA astronaut is 
tethered or is moving about on the surface of any spacecraft using handrails, 
etc. Astronaut should be able to disable thrusters by choice no matter what 
his location. 

Escape/Rescue Requirements for Hazard 3 

Recovery methods for an astronaut with attitude control loss are essentially 
the same as the capabilities listed in the corrective measures. If, however, 
after shutting down attitude control this function is still necessary for a 
return to a safe haven, then the EVA astronaut will need assistance from 
outside in the form of rescue. 
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Effects of Hazard 4 , Propulsion Overburn 

The AMO (astronaut maneuvering unit) has frequently been suggested as a 
means of propelling an EVA astronaut from one location to another during the 
course of space activity. One system uses a hot gas and can supply a AV 
to the astronaut of at least several tens of ft/sec. Should the system fail 
and continue to operate after a command to cease is instututed, the astro- 
naut will be propelled past his destination at a rate that could easily ex- 
ceed 20 ft/sec if he does not steer himself to nullify this effect. 

The astronaut will rapidly extend his distance from his intended destination. 
His capability to return unassisted is made exceedingly difficult, if not 
impossible, since most, or all, of his propellant will be expended. A AV 
of 20 ft/sec will carry him, in 15 minutes, 18,000 feet from his location 
at the burn initiation if he does not maneuver. Implications then follow 
concerning his oxygen supply as well as his propulsion capability. 

Corrective Measures for Hazard k 

The EVA astronaut must have positive capability to shut down thrusters, which 
may be accomplished by cutting off propellant flow, or by cutting off elec- 
trical power to the AMU. This cutoff should not affect life support. 

Alternately, with judicious use of his attitude control system, the astro- 
naut could stay in a desired vicinity by steering himself. Thus, a propul- 
sion overburn may be controlled to the extent of not changing his location 
by any significant amount. 

Escape/Rescue Requirements for Hazard k 

The EVA astronaut must have the capability (as a last resort) to steer him- 
self to remain in the vicinity of his spacecraft in the event of propulsion 
shutdown! failure. A rescue mission will be required if the overburn is per- 
mitted to drive the EVA astronaut away from his normal work area. 
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Hazard 5. Illness during EVA, is discussed in detail in Hazard Study 35* 
Effects of Hazard 6 . Loss of Electrical Power 

Electrical power may be lost by the EVA astronaut through battery failure or 
through failure of other components in the electrical power supply circuit. 
Either of these failures may occur because of failure in the hardware itself 
or through the mechanism of an outside agent; e.g., a meteoroid strike. An 
EVA astronaut using an umbilical will have power supplied by his 'mother' 
spacecraft, and a battery pack only for emergency use should the umbilical 
power line fail. Failure of electrical power shuts down «11 EVA subsystems. 
Communications, temperature control, automated oxygen flow and atmosphere 
cleansing, and propulsion capability are all lost for the astronaut. 

Corrective Measures for Hazard 6 


A separate pack of batteries, for emergency use in the event of prime power 
pack failure, is required for the EVA astronaut. 

If the astronaut is working as part of a team he should have an umbilical to 
plug into the power system of a fellow astronaut and vice-versa. In the 
event of working on the external surface of a spacecraft, and tethered to 
that surface, the astronaut should have the opportunity to plug into external 
power-source plugs located on the surface of all spacecraft including the 
OLS. Such plugs should also make available life support supplies and 
communications . 

The EVA astronaut must have : 

1. A totally independent communications alarm (May-day signal) that will 
activate if his normal electrical power fails, and 
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2. a separate battery pack to power his communications alarm and his pro- 
pulsion system for a minimum of ten minutes to permit return to 'mother* 
spacecraft, 

3. a manual oxygen flow control in the event of power failure, 

4. a suit designed such that loss of electrical power will not cause 
temperature in the suit to rise above 90°F for 30 minutes after power 
loss occurs. 

5. it should be possible for one astronaut to plug into the life support, 
power, and communications of a fellow astronaut in the event of mal- 
function. The buddy system in EVA activity is strongly recommended. 

Escape /Res cue Requirements for Hazard 6 

1 . His electrical power fails and the EVA astronaut now separated from his 
mother spacecraft must be rescued within a time bounded by his manually 
operated emergency oxygen supply which is 30 minutes. 

2. The EVA astronaut becomes 'entangled' in some large structure he is 
assembling and must be extricated with the use of outside aid, and 

a. He has a plentiful supply of consumables to that rescue must be com- 
pleted within 3-4 hours. Also, he is not injured in this instance, or 

b. He is injured and must be rescued post-haste. 

3. The EVA astronaut's propulsion fails "off"; he is not on an umbilical 
and is unable to return to his spacecraft unaided. His consumables 
supplies ares 

a. In good order and plentiful. 

b. In good order but limited. 

4. The EVA astronaut's communications have failed; he is unaware of this 
since he is busy at his assigned task away from his spacecraft. Regular 
voice contact is mandatory, therefore, another astronaut must be sent 
out to bring back the first astronaut. If the astronaut is close to his 
monitoring spacecraft it could be possible to signal him with a flashing 
beacon; he might even wear such a beacon and have it activated by his 
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governing spacecraft. Should continual communications be mandatory then 
the astronaut will quickly be aware of a failure by lack of response 
from his monitor. 

GENERAL COMMENTS 

All of the numbers used in the following candidates for safety guidelines 
represent current best engineering judgment. Further analysis is recommended. 

An alternate and suggested method for EVA tasks - as opposed to long umbil- 
icals and/or free flying astronauts - encompasses the use of a cherry-picker- 
like device attached to a tug, see Fig. 1 . The cherry-picker is composed of 
a cradle and attached cages to hold the astronaut and parts and tools, a 
wristlike joint which is an attach point for the cradle and one-half the 
cherry-picker arm, the second-half of the arm is also attached to the tug 
and at this attach point at least one degree of rotational freedom is 
available. The entire cherry-picker arm folds into a longitudinal slot 
built into the exterior of the tug. When folded, the cradle is at the tug 
airlock. The astronaut is tethered in the cradle and is free above his hips 
to handle tools and parts and to perform a very wide variety of tasks. 
Umbilicals from the tug to the astronaut may be run along the cherry-picker 
arm. An emergency power and ECS supply is fixed to the cradle and plugged 
into the astronaut. It is activated at the turn of a switch. Such a 
device, when and where available, would obviate most of the proposed safety 
guidelines and the various hardware/cost penalties associated with imple- 
menting the guidelines. The safety of the EVA astronaut is vastly improved 
by virtue of use of the cherry-picker. His permissible EVA task time will 
be much more fruitfully used, since he is constantly tethered comfortably, 
works more efficiently, and knows he is safe. 
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HAZARD STUDY - 7 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. In the event of loss of primary electrical power by an orbital EVA astro- 
naut, an emergency battery pack shall supply power to 

a. run the astronaut propulsion unit for a minimum of 10 minutes 

b. keep suit temperature below 90°F for 30 minutes 

c. run a May-day communications alarm for one hour 

d. run a flashing light (wattage to be determined) for at least one hour 

2. EVA astronaut propulsion must fail "off". 

3. An EVA astronaut attitude control subsystem shall be capable of being used 
to keep the astronaut in the vicinity of his spacecraft in the event of a 
runaway propulsion system. 

4. An astronaut shall be capable of disabling any or all AMU attitude control 
thrusters* at all times. 

5. AMU attitude control thrusters for an EVA astronaut shall be disabled when- 
ever he is tethered and not translating. Tethers must be impervious to 
damage from hot gas or other AMU exhaust products. 

6. An EVA astronaut shall have a communications (May-day) alarm, self-powered, 
and activated automatically should his communications subsystem or his 
electrical power subsystem fail. 

7* A communications failure shall lead to an immediate and mandatory return 
to the EVA astronaut T s spacecraft. 

8. All EVA astronauts shall carry a 30-minute emergency oxygen supply to be 
used only in the event of failure of the main oxygen supply. Switchovers 
may be manual or automatic, but a signal of automatic switchover must be 
provided the astronaut. 

9. The emergency oxygen supply feed shall be capable of manual control by 
an EVA astronaut. 

10. An EVA astronaut using his emergency oxygen supply shall have an immediate 
and mandatory requirement to return to his spacecraft. 
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All spacecraft shall have plugs strategically located on their surfaces 
so that an EVA astronaut can attach umbilicals for oxygen, electrical 
power, and communications. 

All spacecraft shall have hand-holds and tethering places strategically 
located on their surfaces so that an EVA astronaut may use these in the 
course of those tasks in which he is located on the spacecraft surface. 

The buddy system - or presence of a safety man - is mandatory when EVA 
astronauts are assigned tasks in which they are operating detached from 
the spacecraft or station. 

The buddy system - or presence of a safety man - is desirable for an 
EVA astronaut assigned to a task on the surface of a spacecraft to 
which he is tethered. 

EVA should be viewed as the method to accomplish tasks outside of 
spacecraft when good judgment by the mission commander (in some cases 
perhaps, with Earth-control concurrence) deems it useful. 

Untethered EVA should be prohibited until an astronaut maneuvering 
unit (AMJ) is developed to the extent of being very reliable. 
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HAZARD STUDY 8 
SATELLITE DEPLOYMENT 


INTRODUCTION 

The deployment of satellites in lunar orbit for scientific purposes is a 

planned activity to be accomplished on-board an orbiting lunar station (OLS) . 

The handling, check out, launching and recovery of these units entails certain 

potential hazards to the personnel involved. This study area considers the 

hazards aspects of satellite deployment activities. 

ASSUMPTIONS 

1. Freeflying satellites (when docked to an OLS) will be docked to the 
experiments airlock docking subsystem and not to OLS docking ports. (Ref.l) 

2. Maintenance and repair of experiment satellites will be performed in an 
experiments airlock, which will be part of the OLS experiments Laboratory. 
(Ref.l) 

3. The satellites to be launched from an OLS may have propulsion systems 
for delivery of instrument packages to orbits unlike that of the OLS. 

(Ref. 1 and 2) 

4. Most satellites will have stabilization/propulsion systems for orientation/ 
stabilization or station keeping purposes. 

5. Shirtsleeve environment for satellite servicing is an OLS operational 
requirement. (Ref. l) 

THE MAJOR HAZARDS 

Hazards considered to be significant are: 

1. Liquid propellant spillage 

2. Liquid or solid propellant ignition/detonation 

3. Electrical fire in experiment airlock (satellite or checkout equipment) 

4. Satellite collision with OLS during capture maneuver 
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ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1. Liquid Propellant Spillage 

The replenishment or initial filling of satellite propellant tankage requires 
manual connection of transfer hoses or pipes. Any misalignment, failure to 
tighten adequately, or entrapment of fuel or oxidizer in quick disconnect 
fitting results in leakage and/or spillage of hazardous fluids. 

1. The introduction of even small quantities of corrosive or explosive 
oxidizer, hydrocarbon fuel or some of the more exotic, storable mono- 
propellants into the airlock atmosphere presents the following hazards: 

a. Toxic material concentrations 

b. Creation of explosive atmosphere 

c. Potential fire hazard 

d. Corrosion of OLS structural materials 

e. Potential rapid oxidation of structural materials and/or metal fire 
involving thin structural OLS segments. 

2. Spillage in zero-g could permit 360° dispersal of active fluid to all 
parts of compartment as well as permitting ingestion by crewmen. The 
ingestion of fuel or oxidizer into the air purification system could 
yield a disasterous situation for the entire OLS section serviced by 
the purification system. 

Effects of Hazard 2 . Propellant Ignition/Detonation 

The servicing of satellites will involve the installation and removal of 
propulsion components in the satellites. Thus failure to purge fuel and 
oxidizer systems thoroughly could result in fluid release during disassembly 
with resulting auto-ignition or detonation. Similarly the installation of 
solid propellant packages can involve accidental ignition and/or grain 
explosion under certain circumstances. 

The sudden ignition or detonation of liquid or solid propellants within the 
confines of the experiment airlock is certain to inflict injury upon the 
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crewmen involved, even if they are garbed in protective clothing. Further, 
the generation of gases involved is quite likely to violate the integrity 
of the airlock compartment and either open it to space vacuum, or to other 
compartments of the OLS, thus propagating the hazard by exposing other crew- 
men. Conceivably the pressure surges could open both inner and outer seams 
causing depressurization of a large segment of the OLS. 

Corrective Measures for Hazards 1 and 2 


Preventive measures: 

1. Refueling of satellites - Provide a design which accepts prepackaged 
(precharged) fuel or oxidizer containers. Containers should have built-in 
check valves which open only after connection is made and final torque- 
down is accomplished. 

2. Provide a' satellite propulsion system design which can be totally blown 
down with small amount of nitrogen which vents overboard through a 
disposable neutralizing trap. Provide a vacuum line to the disconnect 
area so that vapors and fluid droplets are swept out to space. 

3. Provide solid propellant cartridge modules as complete replaceable com- 
ponents such that installation is safe with no-fire condition until the 
satellite is armed just prior to deployment (when airlock is open to 
space) or outside the OLS. 

4. As an alternate to 1 and 3 above, provide a high strength closed chamber, 
mounted on an OLS wall with a blow-out door, in which satellites can be 
serviced using reinforced arm gloves or a remote manipulator. (Requires 
spare blow-out doors) . A hangar could be used for this function with 
tethered crew members in soft suits while servicing the satellites. 

5. All electrical equipment should be properly grounded to ensure that no 
accidental electrical discharge occurs involving satellites or servicing 
equipment . 

Remedial Measures: 

1. Provide emergency lightweight masks with remote air supply as remedial 
measure for toxic fumes. 
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2. Provide warning instrumentation and sensors to detect low levels of 
oxidizers and fuel materials to be used in satellites. 

Effects of Hazard 3 . Electrical Fire in Experiment Airlock 

Electrical fires in the satellite circuiting or test and checkout circuiting 
may result from a number of causes such as shorts, circuit overloads, damaged 
parts, simple random failures or human errors in the test and checkout setup 
or operations. 

The effects of an electrical fire in the test and checkout of a satellite 
will range from simple circuit damage to loss of the satellite and may 
include activation of the pyrotechnics, ignition and/or detonation of pro- 
pellants with subsequent major fire or overpressure generation. Thus a 
simple fire may result in loss of the experiment airlock area and damage to 
the major OLS structure. An electrical fire in the presence of propellant 
vapors would lead to the production of various toxic gases which in turn 
could penetrate the environmental control system. 

Corrective Measures for Hazard 3 

Preventive Measures: 

1. Test and checkout of satellites shall be conducted for the major systems 
while the unit is unfueled. 

2. Final checkout shall be conducted remotely when airlock is open to space 
vacuum. 

3. Use wiring insulation that does not yield toxic gases in combustion. 
Remedial Measures: 

1. Use gas mask if toxic gases appear. 

2. Have vent to space if fire occurs, while crew uses oxygen masks. 
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Effects of Hazard 4 . Satellite Collision with OLS 

The recapture of a satellite (by an OLS) upon completion of its mission 
implies that the satellite can be maneuvered so as to return to the OLS 
vicinity and into the open airlock. The degree of design sophistication 
required for this ambitious undertaking is thought to be somewhat beyond 
current state-of-the-art. However, granting that it is possible for a large 
relatively passive station like the OLS to serve as the target into which 
a satellite must be maneuvered, then a recognizable hazard is the collision 
of the satellite with the OLS if its approach velocity were too great. 

Effects include: 

1. Probable loss or destruction of the satellite. 

2. Possible damage to OLS structures from mass of satellite (velocity 
dependent) . 

3. Possible damage to OLS due to detonation of satellite from propellant 
mixing and ignition upon impact. 

4. Decompression of OLS if satellite penetrates OLS via windowport or thin 
structure area. 

Corrective Measures for Hazard 4 
Preventive Measures: 

The capture of satellite vehicles at the completion of its mission can best 
be accomplished via a tug vehicle which is specifically equipped to snare, 
grab, enclose, or otherwise latch onto the satellite. It is expected that 
the satellite orbit will be known and its spatial position easily determined 
by either OLS or tug vehicle. Further, the satellite would have a trans- 
ponder or beacon for this purpose. Thus a tug could transfer to the orbit 
at an opportune time and effect the satellite capture, shut it down and 
return to station at no danger to the OLS. 
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Excape/Rescue Requirements for Hazards 1 through 4 

Such events as fire and propellant detonation or explosion in the experiment 
servicing area of the OLS will in all probability generate escape and rescue 
requirements for the personnel involved. The collision of a satellite with 
the OLS, either as a direct impact or a grazing collision could also generate 
such requirements. The various aspects of the above hazards have been con- 
sidered in some detail in the Ref. 1 document. 


ADDITIONAL INFORMATION 

It is recommended that satellite servicing be conducted in a pressurized 
hangar separated from the main OLS compartment by an airlock in the general 
manner planned for the Earth Orbiting Space Base. 

SOURCE DATA REFERENCES 

1. Orbiting Lunar Station - Phase A Study Final Report - Sec. 1, Objectives 
and Requirements. MSC-02686, (SD 70-518), dated Oct 1970, North American 
Rockwell, Space Division, Downey, Calif. 

2. Lunar Orbit Stations - Project Description Document, AMPO, MSC, Houston, 
Texas. Dated April 1970. 
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HAZARD STUDY 8 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 

1. Satellite deployment and initiation of operations considered hazardous 
shall be made ready from a remote location before exposing crewmen to 
potential hazards. 

2. Refueling of satellites shall be accomplished by use of prepackaged fuel 
and oxidizer container with built-in valves which open only after final 
installation. 

3* Servicing of satellite propulsion shall only be accomplished after thorough 
system venting and purging. 

4. Vacuum venting of immediate area where system piping or tubing is opened 
shall be accomplished for each system breaching operation involving danger- 
ous liquids or gases. 

5o All solid propellant installations shall be designed to accept a complete 
prepackaged solid propellant module designed to be "no-fire” safe until 
satellite is armed for deployment. 

6. Emergency breathing masks shall be available in the experiment airlock 
as a quick remedy for atmospheric contamination. 

7. Specific warning instrumentation and sensors designed for the satellite 
propellant fluids to be handled shall be installed in areas where such 
fluids are to be stored or handled. 

8. Automatic fault detection equipment utilization shall be employed as the 
first step in the test and checkout of satellites. The sudden rise of 
current above test limit shall cause power cut-off to the test-and-check- 
out setup as a means of preventing electrical fires. 

9* Satellite capture for data return and reuse shall be accomplished via a 
tug specifically equipped for the task, in order to avoid potential col- 
lision problems for the OIS. 

10. Careful attention shall be given to the use of non-flammable materials 
where possible in satellite design. 

11. Grounding and arming of explosive and propulsive devices should be accom- 
plished on a satellite after it has been removed from the orbiting lunar 

station. ^ . 
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HAZARD STUDY 9 

NUCLEAR POWER PLANT OPERATION AT AN ORBITING LUNAR STATION 


INTRODUCTION 

The utilization of nuclear power plant technology for lunar space station 
application is motivated primarily by the sizable station power requirements 
and the logistics constraints inherent in the operation of a distant, self- 
contained facility. The factual recognition of the penalties associated with 
utilization of the only existing device capable of providing multi-kilowatt 
electrical power will permit the evolution of a practical, space-operable 
nuclear power system. 

A study is currently being conducted for the NASA (Ref l) which is intended 
to provide key nuclear safety design guidelines and overall nuclear hazards 
identification for space based nuclear electrical power systems. Therefore, 
this Study Area will only address itself to the major manned lunar explora- 
tion operational mission hazards interfaces generated by the space based 
nuclear power unit. 

ASSUMPTIONS 

1. The synthesized orbiting lunar station with nuclear reactor power module 
is assumed to be configured as follows: 


I- 


200 ft 






Orbiting Lunar 
Station 


Nuclear Power 
System Module 
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2. The operations conducted in and about the orbiting station are the normal 
planned activities as defined in the lunar exploration program model. 

3. The normal planned radiation levels around the nuclear power module are 
such that the detectable natural space radiation level exceeds normal 
shielded reactor emitted radiation level. 


The primary hazard generators, related to manned operations around a lunar 
orbiting station equipped with a nuclear power module of the type considered 
in Ref. 1, are as follows: 

1. The recognized major sources of potential radiation leakage associated 
with the nuclear power module are (Ref. l): 

a. Excessive radiation from the reactor and from components located 
external to the reactor shield 

b. Released fission products from reactor and primary coolant circuit 
assembly 

2. The interfacing lunar exploration program elements and operations exposed 
to the potential hazard generators are: 

a. Orbiting Lunar Station 

b. Tug Vehicle operations 

c. Prime Transport Vehicle operations 

d. Replacement of nuclear fuel or of reactor assembly 

THE MAJOR HAZARDS 

Primarily, the major hazard which can be generated by a function failure 
and/or system integrity violation within the nuclear power module, is the 
exposure of man to excessive amounts of nuclear radiation. 
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ANALYSIS OF THE IDENTIFIED HAZARD 


The routes by which man can be endangered by exposure to excessive radiation 
from a nuclear power module are essentially direct in nature. The time span 
over which the exposures can occur are variable and range from a large, high- 
level pulse resulting from a destructive reactor excursion to a low-level near 
background exposure resulting from leakage between power system coolant loops 
or from plate-out of released fission products on the space station exterior. 
Other typical sources of radiation hazards examined in the Ref. 1 study are 
given in Tables 1 and 2. 


Table 1 

NORMAL SOURCES OF RADIATION 



RADIATION SOURCE 

RADIATION 

ARISING 

FROM 

ABOARD 

SPACE 

BASE 

REACTOR 

POWER 

SYSTEM 

NORMAL REACTOR RAD- 
IATION FIELD 

REACTOR AT POWER 
OR SHUTDOWN 

NORMAL RADIATION 
FROM PRIMARY LOOP 

REACTOR AT POWER 
OR SHUTDOWN 

NORMAL RADIATION 
FROM ACTIVATED 
COMPONENTS 

REACTOR AT POWER 
OR SHUTDOWN 

NATURAL 

ENVIRONMENT 

GALACTIC COSMIC 
RADIATION 

DEEP SPACE 

SOLAR RADIATION 

SOLAR FLARE 


Effects of the Hazard 


Pending definition of the radiation "source-term" for a specific reactor and 
shield configuration to be employed in the nuclear power module, only a 
general approximation of the hazards effects can be made for the various 
accident postulations that are within the realm of credibility. 


2-57 















LMSC-A984262C 




ABOARD 

SPACE 

BASE 


REACTOR 

POWER 

SYSTEM 


ACCIDENT RADIATION 
SOURCE 


EXCESSIVE RADIATION 
FROM REACTOR 


EXCESSIVE RADIATION 
FROM COMPONENTS 
LOCATED EXTERNAL TO 
SHIELD 


ARISING FROM 


REACTOR EXCURSION 

OPERATING OR SHUTDOWN, 
WITH DAMAGED SHIELD 

FAILURE TO SHUTDOWN 


LEAKAGE BETWEEN POWER 
SYSTEM LOOPS 


NORMAL REACTOR RADIA- 
TION ENVIRONMENT 


DESTRUCTIVE REACTOR 
EXCURSION 


RELEASED FISSION 
PRODUCTS 


CLAD AND PRIMARY 
SYSTEM FAILURE 


REACTOR DISASSEMBLY 


NUCLEAR 

SHUTTLE 


ABOARD 

INTERFACING 

VEHICLES 



RELEASED ACTIVATED 
MATERIALS 

• COOLANT 

• STRUCTURE 

• FUEL ELEMENTS 


EXCESSIVE RADIATION 


RELEASE OF FISSION 
PRODUCTS IN ORBIT 

RELEASE OF RADIO- 
ACTIVE DEBRIS IN 
ORBIT 


EXCESSIVE RADIATION 


DESTRUCTIVE REACTOR 
EXCURSION 


PRIMARY SYSTEM FAIL- 
URES OR LEAKS 


TRITIUM RELEASE FROM 
SHIELD 


SHUTTLE COLLIDES WITH 
BASE 

SHUTTLE PASSES IN CLOSE 
PROXIMITY TO BASE 


SHUTTLE REACTOR 
EXCURSION 



TUG COLLIDES WITH 
POWER MODULE 


TUG PASSES IN CLOSE 
PROXIMITY TO POWER 
MODULE 
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A compilation of the anticipated crew allowable exposure limits proposed as a 
revision to the "Provisional Radiation Dose Limits for Manned Space Flight 
Beyond Apollo", originally issued by the NAS A-Radi ati on Constraints Panel, is 
presented in Table 3. This table, taken from Ref. 1, can be utilized to eval- 
uate the relative hazard magnitude associated with credible accidents when 
the respective "source- terms" for the accident have been defined. 

For the nuclear power system employed in the Ref. 1 study the preliminary 
source- terms for the system are defined. Utilizing this data and the lunar 
space radiation environment as defined in NASA TM X-53865 (Ref 2) it is 
possible to compare expected crew dose and exposure limits for an orbiting 
lunar station equipped with a nuclear power supply module of the type and 
configuration employed in the Ref. 1 study. These data are presented in 
Figure 1 . Notice that a single solar flare will nearly deplete the crewman' s 
allowable short-time limit if it occurs early in his tour of station duty. 

For a no-flare condition the crewman would normally receive his largest ex- 
posure from the natural space radiation environment. 

For a typical case of abnormal station radiation level from a nuclear power 
system module (without regard to causative factors) , the effects of the re- 
sulting abnormal ambient radiation level on the crew can be readily assessed. 

As an example, assume that the ambient level in the station has risen to 20 mr/ 
hr of predominatly 1 MEV gamma radiation ( which could be typical of a leak 
between the primary and secondary reactor coolant loops) . Assume, also, that 
a new crew has just started a station duty tour and that the power module is 
being kept on-line because of critical station requirements for supporting 
lunar surface base activities. A replacement power module is not available 
until the next logistics supply mission arrives. The exposure data when 
plotted as in Figure 2 readily presents the cross-over points for crew dose 
limits, the ambient gamma dose, the total man-made and space radiation dose, 
and the impact of a solar event. It can be seen that because of the natural 
space radiation ambient level and the possible magnitude jump due to a solar 
event, there is really very little margin for accommodating further radiation 
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Fig. 2 Crew Exposure Limits and a Postulated Orbiting 
Lunar Station Abnormal Radiation Environment 
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Area 

Depth 

1 Yr. Avg. 
Daily 

30 Day 

Rill 


Career 

Skin (0.1 MM) 

0.6 

75 

105 

225 

1,200 

Eye (3 MM) 

0.3 

37 

52 

112 

600 

Testes (3 CM) 

0.1 

13 

18 

38 

200 

Marrow ( 5 CM) 

0.2 

25 

35 

75 

400 


TABLE 3 - ANTICIPATED CREW RADIATION LIMITS (rem) 

SPACE STATION/BASE, SKYLAB, SHUTTLE 

level increases due to additional problems with man-made radiation sources. 
Should, for instance, the reactor shielding integrity be violated, it is 
quite possible to have station ambient radiation levels which could range up- 
wards to 10 R/hr or better if the reactor viewed the station directly. The 
credibility of such an event being due, for example, to a meteorite strike 
is enhanced by recent data indicating the presence of reasonable populations 
of incoming large meteorites in the lunar vicinity (Reference 3). 

For a significant breaching of the reactor shielding, giving rise to high 
level radiation within the orbiting lunar station, the effects of high level 
exposure upon the crew are predictable. Data developed in a current NASA 
Study (Ref. 1) is presented in Figure 3 illustrating the early time effects 
for acute whole-body exposure resulting from given doses. The chart has been 
constructed such that an estimate of the capability of an individual crewman 
as a function of time after exposure can be identified for various radiation 
doses. The value 50 Rads was taken as the limit below which no debilitating 
effects would occur. Vomiting was taken as the earliest effect which could 
incapacitate an individual crewman. In fact, it has been shown that nausea 
and vomiting occur nearly simultaneously in the onset of radiation sickness 
(Ref. 1). 

The nuclear power module normally would be located some 200 feet from the 
station, probably on the end of an extendible boom, in order to take advan- 
tage of distance as a shielding augmentation factor. A second reason for 
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the distance is the necessity for a very large unobstructed radiator needed 
to reject excess reactor heat. The extended boom and power module are vul- 
nerable to collision and hence must be considered to be within a restricted 
operations volume so far as vehicles operating around the station are concerned. 

Corrective Measures 

Preventive Measures: 

1. A nuclear power supply module attached to the orbiting lunar station 
will necessarily have to be designed to be redundant in all critical 
control systems and to fail-safe for all critical failure modes. 

2. Positive reactor shut-down must be possible under all conditions of 
mechanical malfunctions, shock, or collision. 

3- Reactor-over temperature sensing must cause shut-down prior to thermal 
degradation of core structure and fuel cladding materials. 

4. Reactor shielding integrity must be capable of surviving all credible 
malfunctions for the shield region which faces and shields the space 
station. If the shield must vent to preserve its major area integrity, 
then the venting shall occur in the direction away from the station. 

5. The sudden loss of coolant from the primary coolant loop of the reactor 
must not be possible in less time than required for safe reactor shut- 
down without melt-down. 

6. The reactor shielding shall be designed to be capable of attenuating 
the radiative energy release of the credible postulated maximum reactor 
excursion to levels which do not exceed the allowable crew dose (per 
duty tour) in the space station. 

7. Station radiation monitoring instrumentation telemetry data should in- 
clude one channel which reports ambient radiation levels over the range 
of from background level to and including ten percent above the maximum 
level expected in the station from a credible maximum power module re- 
action excursion. The data thus provided would alert and enable earth- 
base to rapidly access the incident and render such assistance as 
necessary or possible in subsequent contingency activity. Data would 
include dose and dose rate at selected station areas. 
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8. The reactor system employed shall (as a means of enhancing reliability 
and useful life in space) be designed to operate at temperatures well 
within the known capabilities of the proven materials employed in its 
construction. Design safety margins shall not be less than a factor of 
2.0 for the most critical parameter in any given system of subsystem. 

9. The power system module design configuration shall be such that it is not 
possible for a malfunctioning nuclear power system module to inhibit 
access to, or escape or rescue from, the orbiting lunar station by virtue 
of direct gamma or neutron radiation beams or fields. 

10. Design provision shall be made for detaching an expended or failed nuc- 
lear power system module and removing the module from the operational 
orbit via a tug vehicle (remotely operated if necessary). The disposal 
of a spent or failed module will be accomplished by procedures that are 
yet to be determined. 

11. Replacement of nuclear fuel or removal of the reactor assembly would 
have to be provided for by development of techniques for accomplishing 
these procedures remotely using a tug or other appropriate mechanism. 

Alternately, a properly shielded tug, operated by crew members and equipped 

with mechanical manipulators could be used for these functions. 

Remedial Measures: 

1. The orbiting lunar station, if equipped with a nuclear power supply 
module, will require on-board capability for emergency treatment of 
radiation sickness to some limited extent. 

2. The Earth- re turn tug stationed at the lunar orbiting station, must be 
capable (once activated and separated from the station) of autonomous 
or Earth-base directed return to Earth orbit, in the instance where an 
entire station crew has been exposed to radiation levels which will 
produce incapacitation and serious organic degradation. 

3. All crew members will always wear dosimeters, changed at regular intervals 
so as to keep accurate records of their exposures. Dosimeters will be 
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mounted at selected points in the OLS (and other spacecraft) and their 
readings read out on demand by Earth stations, the LSB, orbiting base, 
and other appropriate spacecraft. 

Escape/Rescue Requirements 

Since the station would be provided with only a solar-storm shielded area and 
there is literally no place to retreat to if the station were exposed to large 
fluxes of high energy gamma and neutron radiation, it is therefore necessary 
that it be possible to escape from the station if such an event occurred. The 
station would be equipped with radiation monitoring instrumentation and re- 
actor control equipment as a necessary adjunct to the nuclear power system. 
Preset alarm levels would warn the crew of the rising radiation level and mag- 
nitude of the station radiation emergency. A predetermined level alarm would 
call for station abandonment to be instituted. The crew would then be required 
to escape. In the unlikely (but possible) case of a reactor excursion, it is 
probable that the excursion radiation, impinging on the station, would take 
the form of a brief but very high level pulse lasting up to one or two min- 
utes followed by a decaying field level as the reactor either shut down or 
came apart and became noncritical. Such a situation might subject the station 
to radiation levels which, though brief, could induce subsequent radiation 
sickness. It is likely that such a situation would require external assist- 
-ance in the form of rescue and aid. 

SOURCE DATA REFERENCES 

1. "Space Base Nuclear System Safety Study," First Performance Review, 
GESP-7059, General Electric Co., Nov. 24, 1970. 

2. "Natural Environment Criteria for the NASA Space Station Program," 

2nd Ed., NASA TM X-53865, MSFC August 20, 1970 

3. "Date from U.S. Lunar Station Show Cold, Stiff Moon Regularly Bombarded 
by Meteorites" by H. M. Schmeck, Jr., New York Times, Nov. 19, 1970. 

4- "Radiobiological Factors in Manned Space Flights," W. H. Langham, Ed., 
National Academy of Sciences, National Research Council, Washington, 

D. C., (1967). 
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HAZARD STUDY 9 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. The radiation shielding incorporated in the nuclear power system module 
shall be capable of attenuating the radiative energy and particle release, 
for the postulated maximum credible nuclear source accident, to levels 
which do not exceed the allowable crew dose, per duty tour, in the orbit- 
ing lunar station. 

2. The nuclear source shielding integrity shall be such that it will survive, 
in an integral condition, all assaults resulting from source system mech- 
anical malfunctions, thermal shock, and vehicle collision. Further, 

the shielding area facing the station shall survive intact the postulated 
maximum credible nuclear source accident. 

3. It shall not be possible for a failed or failing power module to inhibit 
access to, or escape or rescue from, the orbiting lunar station by reason 
of direct exposure from gamma or neutron radiation. 

4. The nuclear energy source (reactor) shall be capable of positive shut- 
down in any orientation and under all conditions of mechanical malfunction. 
The source reactor shall fail-safe to a shut-down condition for all credible 
nuclear transient conditions. 

5. The nuclear power system module shall incorporate design features 
which permit remote detachment of the module by a tug vehicle for dis- 
posal purposes. 

6. Flight operations in and around the station shall be constrained to avoid 
the restricted volume around the power module for a distance determined to 
be safe. 

7. The station telemetiy link to Earth shall sample and report the ambient 
radiation level in the station at any time when the radiation values 
exceed an established background nominal. The TM shall regularly report 
dose and dose rate at selected station areas. 
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8. Replacement of nuclear fuel for the reactor or replacement of the reactor 
itself will be accomplished using techniques that ensure that the crew 
members involved do not receive an injurious radiation dose. Actual 
permissible dose, in the light of the importance of this operation, 
should be determined. 

9. Each crew member shall always wear a dosimeter, changed at regular inter- 
vals so as to keep accurate records of radiation exposure. Dosimeter 
readings will be reported regularly, or on demand, to Earth stations, 

to the LSB or to other appropriate spacecraft. 
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HAZARD STUDY 10 

LOSS OF PROPULSION AND/OR CONTROL OF A MANNED TUG IN ORBIT 
INTRODUCTION 

Successful completion of any orbital tug maneuver or transfer operation is 
dependent on a functioning reaction control system (RCS) . This system 
provides propulsive thrust for minor delta velocity needs and docking 
maneuvers in addition to attitude control. Where large delta velocities 
are required, both the primary propulsion system and the RCS must function. 

This study examines the hazards resulting from failure of either primary 
propulsion or RCS or both during lunar orbital operations. Descent to and 
ascent from the lunar surface are discussed in Hazard Study 1 6 . 

ASSUMPTIONS 

1 . The propuls ion/RCS failure does not disturb other subsystems such as 
life support and communications. 

2. The tug carries a crew of two to six men. 

3. External assistance may or may not be available. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1 . A crew is stranded in lunar orbit in a tug without primary propulsion 
and/or attitude control, and the vehicle may or may not be tumbling. 

2. A tug in lunar orbit with primary propulsion and/or attitude control 
failed has been rendered unavailable for use in rescue situations. 

A tug in lunar orbit with primary propulsion failed presents a collision 
hazard . 
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ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 . Stranded Crew 

Stranding of a crew in orbit may result in depletion of necessary expendables 

sind in illness or death from excessive tumbling rates or duration. 

Corrective Measures for Hazard 1 

Preventive measures : 

1 . Provision of adequate expendables to sustain the crew until remedial 
measures can be taken. A seven-day supply appesirs to be adequate for 
orbital emergencies. 

2. Use of RCS thrusters to return to a nearby safe haven, assuming primary 
propulsion has failed but the RCS is operating and can provide the 
necessary delta velocity. 

3. Provision of a small secondary propulsion system to back-up the primary, 
and provision of two independent attitude control systems, each having 
the capability to provide translational delta velocity. The secondary 
propulsion system is independent of the control systems. It provides 
translational capability to the limit of main propellant exhaustion and 
is a small investment for the safety provided. 

4. Use of two tugs for initial orbiting lunar station manning operations 
where outside assistance will not be available in lunar orbit. Because 
the initial crew is far from aid it is incumbent upon mission planners 
to ensure a substantial degree of safety to this crew. Historically, 
most vehicle failures are of the propuls ion/controls type. Therefore, 

an alternate method of ensuring propulsion capability would be to provide 
two complete propulsion stages and intelligence units mounted in tandem, 
useable one-at-a-time, and surmounted by a single crew cabin. 

5. Provision for manual control of each RCS thruster separately. 
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6. Provision for the crew capsule and instrument unit (IU) to separate from 
a failed propulsion module. This would allow the RCS, assumed part of 
the IU, to provide a much greater delta velocity if needed to return 
the crew to a safe haven. 

Remedial measures: 

1 . External assistance from a second vehicle to stop tumbling, provide any 
needed consumables, and propel the disabled tug and crew to a safe 
haven. If the tumble rate is slow enough the crew could wear PLSSs and 
leave the tug by jumping out where they will be picked up by a rescue 
spacecraft waiting close by for them. Should the tumble rate be large 
enough so that the crew could not exit in this manner then some method 
will have to be used for slowing the tumble rate or stopping it. The 
problem is too complex to give specific details here; a separate study 
is warranted. 

Escape/Rescue Requirements for Hazard 1 

A rescue vehicle must be provided to rendezvous with a disabled tug in 
lunar orbit, arrest tumbling motions if present, provide expendables if 
needed, and propel the disabled tug and crew to a safe haven. If the 
tumbling cannot be arrested, provision must be made for removing and rescuing 
the crew via EVA. 

Effects of Hazard 2. Disabled Tug Unavailable for Rescue Support 

Disabling of any tug in lunar orbit renders that vehicle unavailable for 
rescue service. Further, if this disabled vehicle requires outside 
assistance a second rescue vehicle must be committed to that duty. If only 
two vehicles with rescue capability are normally based in lunar orbit this 
hazard could occupy both, and leave other orbital and surface systems 
unprotected. 
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Corrective Measures for Hazard 2 


Preventive measures : 

1 . Provision of self-help capability for the disabled tug to avoid need for 
assistance. Possible self-help methods include: 

a. One or two AMUs aboard the tug which may be worn by one or two 
astronauts could be used to tow the other astronauts to a safe 
haven provided it was within the range capability of the AMUs. 
Optimally the PLSS-wearing crew could leave the tug and orbit 
until they were within range of a safe haven that could be reached 
by the use of the AMUs. 

b. An auxiliary propulsion unit attached to the exterior of the tug 
and detachable from it could serve the same purpose. 

2. Provision of a minimum of three vehicles in the lunar complex with the 
capability of supporting a rescue mission. One tug is assumed to be on 
the lunar surface engaged in a sortie-investigation, a second is presumed 
to be engaged in orbital operations away from the space station, and the 
third is docked at the station, quiescent, monitored, filled with pro- 
pellant and ready for any rescue situation. 

No remedial measures have been identified for Hazard 2. 

Escape/Rescue Requirements for Hazard 2 

No additional escape/rescue situation is identified, but a backup rescue 
vehicle should be made available. 

Effects of Hazard 3 . Potential Collision 

A disabled tug in lunar orbit presents a potential collision hazard to other 
orbital systems. If the reaction control system, with translation capability* 
is operative then collision can be avoided. The hazard results only when 
attitude control is lost. 


2-72 


LMSC-A984262C 



m 



Corrective Measures for Hazard 3 
Preventive measures : 

1 . Provide two independent attitude control systems, each having the capa- 
bility to provide translational delta velocity of 50-to-100 ft /sec. 

Remedial measures : 

1. Rescue of crew and capture of the disabled tug by a rescue vehicle. 

2. Disposal of a derelict tug, following crew removal, by deorbiting or by 
returning it to a lunar station for repair. 

Escape/Rescue Requirements for Hazard 3 

A rescue mission is required to remove a disabled orbital vehicle from 
danger of collision with other systems in lunar orbit. 


* 


% 
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HAZARD STUDI 10 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Each manned tug on a solo mission in lunar orbit shall carry expendables 
adequate to support the crew for a period of seven days beyond the planned 
mission time. 

2. Two independent reaction control systems shall be provided on each manned 
tug, with each system having the capability to provide translational delta 
velocity of 50 - 100 ft/sec. 

3. A small secondary maneuvering propulsion system oriented in the same direc- 
tion as the main engines and operating off the main propellant supply, shall 
be provided to back up the primary propulsion system of any tug in lunar 
orbit. 

4 . Where outside assistance cannot be available, such as during initial man- 
ning of an orbiting lunar station, the crew compartment of a manned tug in 
lunar orbit shall be carried on two complete tug propulsion modules and 
instrument units mounted in tandem. 

5- The crew of a manned tug in lunar orbit shall be provided the capability 
for manual control of each RCS thruster separately. 

6. Each crew capsule and instrumentation unit, including RCS, on a tug in 
lunar orbit must be provided the capability to separate from a failed pro- 
pulsion module and proceed to a safe haven or await rescue. 

7. When lunar surface missions are being performed, a minimum of three vehicles 
capable of supporting an escape or rescue mission must be provided; one is 

a standby reserve vehicle in lunar orbit; one is a mission vehicle in lunar 
orbit; one is a mission/escape vehicle on the lunar surface. 

8. A capability for a rescue vehicle to arrest a tumbling manned tug in lunar 
orbit, provide any needed consumables, and propel the disabled tug and 
crew to a safe haven must be provided. 

9. A capability to dispose of, or salvage, a derelict tug in lunar orbit, 
following removal of the crew, must be provided. 
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HAZARD STUDY 11 
COLLISION IN LUNAR ORBIT 


INTRODUCTION 

Collision in lunar orbit could occur between two space vehicles or between a 
vehicle and space debris. The probability of such an occurrence, resulting 
in a hazard to lunar crewmen, appears to be quite low if spacecraft trajec- 
tories, orbits, and relative velocities are carefully planned and controlled. 

Meteoroid collisions are discussed separately in Hazard Study 38* 

ASSUMPTIONS 

It is assumed that each spacecraft arriving, departing, or operating in lunar 
orbit has propulsion and attitude control subsystems permitting control of 
trajectoiy and velocity and evasive maneuver capability. 

THE MAJOR HAZARDS 

A collision in lunar orbit could have very serious consequences, ranging from 
damage to spacecraft subsystems and rupture of pressure shells to total de- 
struction through crushing, explosions, and fire. This study cannot deal ad- 
equately with the multitude of situations that could result from a collision, 
but rather will suggest measures that can be taken to prevent collisions from 
occurring. 

ANALYSIS OF IDENTIFIED HAZARDS 
Effects of the Hazard 


As discussed above, the effects of a collision can vary so widely that this 
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aspect cannot be adequately covered in this study. The approach taken is to 
eliminate the "effects" by avoiding collision. 

Corrective Measures to Prevent Collision 

Collisions may to a large extent be avoided, or limited to very minor, non- 
hazardous events by operational planning and procedures, collision risk de- 
tection, and avoidance capability. The following preventive measures are pro- 
posed. Where numerical limits are suggested, additional study is recommended 
for verification. 

1. No two undocked spacecraft should be based in near-identical or inter- 
secting orbits. 

2. No two spacecraft should be permitted to approach each other on a colli- 
sion course either with main propulsion engines "on" or with a closing 
velocity greater than about 2 ft/sec. 

3- A vehicle intending to dock in orbit shall not be placed on a collision 
course with the primary propulsion burning. 

4. All prime transport vehicles arriving in lunar orbit should rendezvous 
at an altitude different from that of the target station by 1000 ft or 
more. 

5. To accomplish docking following rendezvous, altitude adjustment should 
occur first followed by establishment of an intercept trajectory. Only 
docking thrusters should be used, and closing velocity limited to a max- 
imum of about 2 ft/sec until about 200 ft from contact. From 200 ft to 
contact velocity should be limited to less than 1 ft/sec. 

6. Vehicle or subsystem appendages should be kept clear of docking areas 
on space vehicles. 

7. Spacecraft docking mechanisms should be designed to absorb twice the 
normal maximum expected docking impact energy without damage. 

8. Spacecraft departing a second vehicle should first make an altitude ad- 
justment sufficient to ensure that orbits are non-intersecting before 
initiating main thrust. This ensures that no common orbital point will 
exist if departure propulsion or control should fail. 
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9. The position of space debris in orbit about the Moon should be monitored, 
and each such debris should be removed at the earliest opportunity should 
any danger of collision exist. If debris removal is impractical, space- 
craft threatened with collision should select a new, safe orbit. 

Escape/Rescue Requirements 

If collision occurs in lunar orbit, rescue may be required. 
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HAZARD STUD! 11 

SUMMARY OF’ SAFETY GUIDELINES CANDIDATES 


The following guidelines are proposed as candidates to help avoid collisions 

in orbit about the Moon: 

1. No two space vehicles or structures shall be based in near-identical or 
intersecting orbits. 

2. No two space vehicles shall be permitted to approach each other on a col- 
lision course either with main propulsion ,: on" or with a closing velocity 
greater than about 2 ft/sec. 

3. A vehicle intending to dock in orbit shall not be placed on a collision 
course with the primary propulsion burning. 

k. To accomplish docking following rendezvous of two vehicles in orbit, alti- 
tude adjustment shall occur first, followed by establishment of an inter- 
cept trajectory. Only docking thrusters shall be used for velocity adjust- 
ment, and closing velocity shall be limited to a maximum of about 2 ft/sec 
until about 200 ft from contact. From 200 ft to contact the closing velo- 
city shall be limited to less than 1 ft/sec. 

5. Docking areas on space vehicles shall be kept free of vehicle or subsystem 
appendages such as engines, antennas, and solar cells. 

6. Docking mechanisms shall be designed to absorb twice the normal maximum 
expected docking impact energy without damage. 

7 . Spacecraft departing from a second vehicle shall first make an altitude 
adjustment sufficient to ensure that orbits are non-intersecting before 
initiating main thrust. 

8. The positions of all objects in lunar orbit, including space debris, shall 
be monitored. Debris shall be removed at the earliest opportunity should 
any significant possibility of collision exist. If debris removal is not 
practical, the orbit of vehicles threatened with collision shall be appro- 
priately altered. 
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9. Each manned vehicle in lunar orbit shall be constantly monitoring other 
traffic, emergencies, or malfunctions that could present a hazard and 
shall have the ability to maneuver to avoid collision. 

10. Orbital tugs shall have the capability to capture and control or dispose 
of any vehicle or object in lunar orbit. The vehicle may be chemical or 
nuclear powered, stable or tumbling. 
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HAZARD STUDY 12 

MANNED TUG MANEUVERING ERRORS IN THE VICINTY 
OF A NUCLEAR PROPULSION STAGE 


INTRODUCTION 

A manned tug, operating in the vicinity of a nuclear propulsion stage, must 

be constrained in its mode of approach to avoid the hazard of nuclear radia- 
tion. This study considers the extent of the operating constraints and the 

consequence of violating these constraints. 

ASSUMPTIONS 

1 . Transfer of all payload cannisters or crew transport modules from a 
nuclear powered vehicle to an oribiting lunar station and elsewhere is 
accomplished by, or controlled from, a manned tug. Where an unmanned 
tug is used for actual transfer, it will be under control of a manned 
tug physically located nearby. 

2. Primary responsibility for tug maneuvers is vested in the tug commander. 

3. The nuclear powered transport vehicle, the orbiting lunar station, and 
the propellant depot are assumed to be stable passive targets for ren- 
dezvous and docking activities of the tug vehicle. 

4. Tracking information is initially provided by the orbiting lunar station 
until target acquisition is accomplished by the tug vehicle. After 
acquisition the tug provides its own data. The orbiting lunar station 
continues to monitor the tug and target until out of range. 

5. A tug crew for orbital sorties and logistics operations is assumed to 
vary between two and six men. 


The principle hazard generators are those planned or unplanned maneuvers 
which place the manned tug in close proximity to a nuclear powered vehicle , 
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but outside of the radiation shielded cone envelope in the forward region of 
that vehicle. The region protected by the nuclear engine shield and the 
tankage for a typical nuclear propulsion state is approximately a 30° cone 
aligned with the vehicle axis, having its apex at the engine reactor core 
center point. The shield region geometry is illustrated in the following sketch. 


SHIELDED 

CONE 

REGION 



TYPICAL NUCLEAR POWERED VEHICLE 


The inadvertent placement of the tug crew in the radiation environment of the 
nuclear stage can arise as the result of one of several sets of circumstances : 

1. From human error in trajectory data input which permits the tug to arrive 
at the nuclear stage in the region of the nuclear engine exposure. 

2. From faulty guidance and navigation equipment. 

3. From erroneous range data resulting from malfunctioning range radar. 

4. From failure to verify nuclear stage orientation prior to approach re- 
sulting in closure on nuclear engine in a darkside passage. 

5. From a closure velocity error which requires a translation maneuver to 


2-81 



LMSC-A984262C 


miss collision with nuclear stage payload and permits the tug to penetrate 
an unshielded region. 

6. From propulsion systems inoperative on-board the tug, leaving the tug with 
excess velocity relative to the nuclear stage and causing passage through 
the engine radiation field. 

7. From failure of the tug power system during tug/nuclear stage rendezvous 
sequence causing the tug to drift by the nuclear stage at low relative 
velocity. 

THE MAJOR HAZARD 

The major hazard generated by inadvertent entrance into the unshielded radia- 
tion region around the nuclear stage is the potential exposure of man to 

excessive amounts of nuclear radiation. 

ANALYSIS OF THE HAZARD 

The hazard identified is exposure of men in a tug crew compartment to nuclear 

radiation while operating in the vicinity of a nuclear propulsion stage. 

Effects of the Hazard 


The penetration of a tug vehicle into the radiation environment surrounding 
the nuclear powered vehicle will result in crew exposure of some magnitude. 

The effects of such an exposure will range from a small increase in the crew 
radiation dose burden, to major significant dose increases which can expend 
the crew allowable dose limit, to a crew dose burden reaching into the physio- 
logical damage region. 

The crew dose in all seven of the cited situations is a function of the ex- 
posure time and the spatial position radiation dose rate. Since the crew will 
be moving through a region of changing dose rate as the radiation source is 
approached and passed, the integrated dose to the crew is normally computed 
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for small time steps to accommodate the changing exposure function. For pur- 
poses of this study, however, it is sufficient to make a conservative approxi- 
mation of the expected exposure values and address the problem in terms of 
these approximate values. 

The respresentative situation to be considered is given as follows: 

Assume that a nuclear stage payload is to be removed one day after arrival at 
the Moon. Further, assume that the tug vehicle in performing the necessary 
orbit transfer and phasing maneuvers to achieve rendezvous with the nuclear 
stage suffers a loss of power in the final orbit circularization maneuver such 
that the tug will fly by the nuclear stage. For the analysis it is assumed 
that the fly-by velocity is on the order of 1 meter per second relative to the 
nuclear stage and the tug will pass the nuclear engine at a distance of 30 
meters. Taking the stage and payload length to the nuclear engine (reactor- 
core) center to be close to 53 meters, it is then possible to compute the tug 
crew exposure resulting from the postulated mishap. 

Ref. 1, Supplemental Data Report No. 1 presented in Appendix E, should be 
consulted and considered a part of this study. Several Figures from Ref. 1 
are pertinent to the following discussion. The ambient fission-product dose 
rate at a position 30 meters from the side of the NERVA nuclear engine is 
given in Figure 4 of Ref. 1 . The data are presented for a view angle of 90° 
as a function of time after engine shutdown. Dose - distance data over a 
wider range of distance is given in Figure 5 of Ref. 1 . 

The variation in gamma radiation dose rate for the entire engine view-angle 
range seen by the tug in its fly-by is obtained from Figure 6 of Ref. 4. 

The appropriate "view-factor" is applied to dose rate data from Figures 4 
and 5 of Ref. 1 to obtain a corrected dose rate for any point in the tug path. 

Figure 1 presents the corrected dose rate profile for the tug fly-by of the 
nuclear engine. Included is a sketch of the fly-by situation showing the 
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parameters considered. The integrated tug crew exposure values as a function 


of fly-by velocity are given below for a 

tug/nuclear engine 

of 30 meters and an engine shutdown time 

of one day. 

Velocity 

Crew Dose 

(Meters/Sec) 

(rem) 

3.04 

0.4 

1.0 

1.2 

0.304 

3.9 

0.0304 

39.0 


In all cases the exposure integration was performed over the time required 
for the tug to traverse 600 meters relative to the nuclear stage. The data 
clearly illustrate that the tug stay-time in close proximity to the nuclear 
engine must be controlled to minimize crew dose accumulation. A disabled 
tug in close proximity to a nuclear stage must be removed as expeditiously 
as possible. 

Corrective Measures 


Preventive Measures: 

1 . Tug vehicles shall be equipped with on-board radiation sensors and instru- 
mentation which alarm and call attention to the fact that the vehicle is 
penetrating a region of increasing radiation level. 

2. Tug vehicles shall be so designed that total failure of all on-board pro- 
pulsion capability or attitude control cannot result from failure of a 
single system or subsystem. 

3. Normal tug operating procedures shall require phasing termination, in 
the vehicle radiation shield cone, at a distance of at least 350 meters 
from a nuclear powered vehicle. 

4. Do not plan activity around the NPTV until it is stabilized and has been 
shut down for one or more days. 
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Remedial Measures: 

None identified. 

Escape/Rescue Requirements 

Should the tug become totally propulsion disabled, as in the above situation, 
external assistance will be required to remove it from the vicinity of poten- 
tial radiation exposure. 

SOURCE DATA REFERENCES 

1 . "A Study to Evaluate Radiation Exposure to the Orbiting Lunar Station 
and Lunar Surface, Related to the Reusable Nuclear Shuttle Operations" 
Supplemental Data Report No. 1, Appendix E, of this report. 

2. Nuclear Stage PDD, MSC, April 13, 1970. 

3. Nuclear Shuttle System Definition Study, Phase III, Monthly Progress 
Report, LMSC-A980259, November 15, 1970. 
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HAZARD STUDY 12 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 

The safety guideline candidates derivable from the analysis are as follows: 

1 . No single function failure of any system or subsystem on board a tug shall 
result in loss of capability to control attitude and velocity of that tug. 

2. Normal tug operating procedures shall require phasing termination, in the 
vehicle radiation shield cone, at a distance of at least 1,150 ft from a 
nuclear powered prime transport vehicle. 

3. Tug operations in the vicinity of a nuclear prime transport vehicle shall 
be constrained by adequate procedures such as rigid control of approach 
path - velocity - distance parameters, to prevent inadvertent intrusion 
into the nuclear vehicle radiation zone during normal transfer and phasirg 
maneuvers . 

4. No activity shall be planned around a nuclear stage until it is stabilized 
and the nuclear engine has been shut down for at least 24 hours. 

5. Tug vehicles shall be equipped with on-board radiation sensors and 
instrumentation with provision for auto-alarm whenever the tug vehicle is 
penetrating a region of increasing radiation level. 
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HAZARD STUDY 13 
PROPELLANT DEPOT IN LUNAR ORBIT 


INTRODUCTION 

This study area includes discussion of hazards associated with depot basing 
schemes and propellant transfer methodology for a propellant depot in lunar 
orbit. The consideration of a propellant depot on the lunar surface, as well 
as discussion of the necessity for a propellant depot in the lunar complex, 
is dealt with in Section 3* 

The establishment and use of a propellant depot (or farm) in lunar orbit in 
some form is assumed for the conduct of manned operations including rescue on 
the Moon and in lunar orbit (see Section 3- ) Such a propellant farm 

can take many forms and be located either at (i.e., attached to) an orbiting 
lunar station (OLS)or sited in orbit at some convenient distance from the OLS. 
If separate from the OLS, the farm can be completely dormant and serve only to 
receive and transfer propellants from or to a spacecraft. Alternately, it 
may be desirable to maneuver the farm to be near or docked at the OLS for pro- 
pellant transfer operations. If the latter, the farm may be maneuvered to 
the OLS unmanned or a pilot may be put aboard for this purpose. A special 
case of the maneuverable propellant farm is that of tug alone loaded with pro- 
pellant in lunar orbit. 

There is a distinct lack of knowledge in a number of areas which inhibits a 
complete discussion of this topic; these include: 

1. The lunar environment is not defined well enough in that the frequency 
and sizes of meteoroids as a function of time (per unit area, assuming 
isotropic distribution) is not known. The statistics supplied by the 
Lunar Orbiters are insufficient. 

2. The entire area of propellant depot design has no substantial definition. 

3. The power system for operating the depot propellant transfer functions 
has not been determined. 
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4- The degree of automation in loading and unloading procedures for pro- 
pellant at the depot is unknown. 

In order to make well founded decisions on the propellant depot basing and 
transfer techniques, detailed studies will have to be conducted in each of 
the areas noted. It is recommended that such studies be instituted. 

ASSUMPTIONS 

a. The propellant depot is in the same orbit plane with the OLS and has 
the same perigee and apogee. 

b. The depot is never further than 200 miles away, and preferably closer 
for spacecraft delivery of propellant to the depot or for transfer of 
propellant to a spacecraft. 

c. The depot has attitude control at all times in lunar orbit. 

d. The depot has its own power supply for pumps for propellant transfer 
to and from depot tanks. If the depot does not have its own power, 
a considerable demand will then be made on the power system of the 
vehicle conducting the propellant transfer. 

e. Whole tanks of propellant may be transferred to the using spacecraft; 
i.e., tank plus propellant; alternately propellant may be pumped 
aboard. 

f. The depot has a framework into which the tanks are set. The frame 
carries a series of flashing lights and beacons. The frequency for 
these beacons are made known to all space-faring nations. 

g. All of the depot framework is designed with tethering places and hand 
holds so that, if necessary, an EVA astronaut can reach a working 
position at any tank connecting link or at any propellant transfer 
connection. 

h. A separated depot in less than 200 miles from the lunar station, 
preferably much closer. It is recommended that a study be conducted 
to determine the optimum method(s) for station-keeping for the depot. 

i. In the case of a depot attached to a space station, it is in a position 
facing the lunar surface and rigidly attached. In the event of such 
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a need, that portion of the depot holding the tanks should be separ- 
able from the space station. 

j. Unattached, the depot may be rotated to aid in the propellant trans- 
fer process. 

k. An entire station with depot attached will not rotate as a unit to 
initiate acceleration for propellant transfer. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Collision between depot and spacecraft. 

2. Explosion of a loaded or partially loaded tank due to a meteoroid strike. 

3. EVA astronaut on umbilical gets entangled in depot. 

4. Tank mishandled when being transferred to depot, 'escapes* to form hazard 
in depot t- OLS orbit. 

ANALYSIS OF IDENTIFIED HAZARDS 

Hazard 1, Collision between the Depot and a Spacecraft, is dealt with in 
Hazard Study Hand is not, therefore, repeated here. 

Effects of Hazard 2 . Meteoroid strike on propellant tank 

An explosion of a propellant tank will result if it is struck by a meteoroid 
large enough to penetrate the tank and impart sufficient energy to the pro- 
pellant. If such an event occurs at the time that a propellant transfer 
operation is underway, the spacecraft involved could be severely damaged or 
destroyed. The depot could sustain damage ranging from destruction of the 
struck tank to severe degradation of all operations with the depot. 

As a result of such an explosion, the safety of other spacecraft crews in 
lunar orbit will be endangered by debris that has orbits intersecting those 
of such spacecraft. 
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Some debris will almost certainly be deorbited so that the crews of vehicles 
and shelters on the surface could be struck. 

A severe explosion could be generated by a meteoroid strike with the depot 
and could cause damage to the attached OLS to the extent of piercing the 
main cabin and causing a loss of atmosphere which then endangers the entire 
crew. Cabin atmosphere may be lost over periods ranging from minutes to 
hours. The latter period implies a puncture repairable, perhaps, with some 
of the crew in space suits and others in safe isolatable areas j this level 
problem will not be considered further. The loss of atmosphere measured 
in minutes is our present concern. The effects of such an event include: 

1. Loss of atmosphere and subsequent loss of crew in ruptured cabin area 
unless crew can get to safe compartment soon enough. 

2. Loss of communi cations through debris collision. 

3. Severe da m age to tugs docked to OLS leading to degradation of rescue 
capability. 

Corrective Measures for Hazard 2 
Preventive Measures : 

1. A propellant depot attached to an OLS should be in the OLS 'shadow'. 

This lessens the area for a meteoroid strike on the depot. The depot 
would be attached to the OLS on the side facing the lunar surface. 

2. A grid srould be considered for placement between an 0Xi5 and a propellant 
depot so that large debris from any propellant tank explosion will be 
deflected or trapped. The grid should 'shadow' all of the OLS plus tugs 
parked at end ports of the OLS. 

3. Design meteoroid shields into all tankage with shield protection cap- 
ability to be maximum obtainable within engineering feasibility and 
cost factors as deemed appropriate. Established meteoroid design 
criteria should be used. 

4* In addition to protection offered in 3 above, design a detached depot to 
maintain gravity-gradient- supported attitude and add a meteoroid shield 
to depot frame in horizontal plane on face furthest from lunar surface. 
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Remedial Measures: 

1. Large chunks of debris with intersecting orbits should be captured by 
tug and deorbited to the lunar surface. 

2. Prevent collision by capturing large chunks of debris in intersecting 
orbits. Eventually capture all debris on intersecting orbits. 

Escape/Rescue Requirements for Hazard 2 

1. Orbiting lunar stations should be compartmented so that multiple areas 
exist for the crew to go to in the event of one pierced cabin. 

2. Rescue will probably be required in the event of a propellant depot 
explosion adjacent to an OLS. 

3- If spacecraft at a detached propellant depot are damaged, rescue will 
be required. 

Effects of Hazard 2 . Astronaut Entangled in Depot 

An astronaut in EVA mode connected to his spacecraft by long umbilical and 
performing operations at propellant depot gets entangled in the propellant 
depot and therefore is unable to return to his spacecraft. The astronaut 
could run out of consumables and be lost if he is not rescued. In efforts 
to free himself, the astronaut may detach his umbilical or rip his spacesuit 
and therefore lose oxygen and be asphyxiated. 

Corrective Measures for Hazard 3 

Preventive Measures: 

1. Wear PLSS for all propellant depot EVA operations. 

2. Use cherry picker-EVA mode described in Hazard Study J. 

Remedial Measures: 

1. First aid — resuscitation methods in a safe enclosure should be applied 
by fellow astronauts engaged in rescue if the rescuers are late in 
arriving. The use of the buddy system will ensure early aid and may be 
a preventive method as well. 2-92 
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Escape/Rescue Requirements for ? 

1. If umbilical is to be worn, then also wear a 30 minute PLSS. Cut 
entangled umbilical free after activating PLSS and return to spacecraft 
immediately. 

2. Send second EVA astronaut out to disentangle first astronaut. 

Effects of Hazard A . Mishandled Tank Escapes 

One of the suggested methods for attaching loaded tanks to the propellant 
depot encompasses the use of manipulators and automatic connection devices. 
Another requires EVA astronauts to connect the tanks, independent of the 
method used for such installation a misstep can lead to the tank floating 
free in orbit and consequently presenting a hazard to the depot and other 
spacecraft in lunar orbit. The hazard may occur, of course, in detaching 
a tank from the depot. The effects that may occur due to a tank floating 
free in lunar orbit include: 

1. Collision with other spacecraft (including the OLS and the propellant 
depot). A derelict in lunar orbit. 

2. Collision with the EVA astronaut handling the procedures for attaching 
the tank to the depot with resulting injuries to the astronaut. 

3. Loss of all the propellant in the tank if it is a full one. It may be 
a last available tank and needed for rescue. 

Corrective Measures for Hazard A 

Preventive Measures: 

In delivering or removing a tank to or from a depot, add a design element to 
permit tethering to the depot or tug before release from the delivering 
spacecraft or release from the depot. 

Remedial Measures: 

In designing tanks add handles or rails for grasping by the tug in retrieval 
procedure, should tank actually float away from the depot. 
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Escape/Rescue Requirements for Hazard A 
None necessary. 

Additional information: 

Overfilling or underfilling propellant tanks were examined from the hazard/ 
safety viewpoint. An overfilled tank vents to space, and at worst some pro- 
pellant is lost from one of the tanks involved. Only one propellant is trans- 
ferred at a time. Moreover, LOX and are not bypergolie. Any escaped pro- 
pellant will quickly dissipate in the space environment. If it is spacecraft 
tanks that are being filled, there would have to be a double failure to over- 
fill; failure of measuring devices on both the depot and the receiving craft. 
Additionally, the two measuring devices would have to register equal amounts 
dispensed and received in order for the failure to be overlooked by the 
monitoring crew members. 

The procedures leading to underfilling in either direct-ion - to or from the 
depot - would also require two failures with both dispenser and receiver 
measuring devices not only failing but showing identical and incorrect 
amounts of propellant transferred. 

Such double failures together with identical errors on both (failed) measur- 
ing devices are thought to be completely unrealistic. 
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HAZARD STUDY 13 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Always tether propellant tanks the depot during delivery* or to tug dur- 
ing removal, to prevent these tanks from becoming a collision hazard in 
orbit. 

2. EVA astronaut (s) should not use long umbilicals in and about a pro- 
pellant depot in order to avoid entanglement of the umbilical with any 
part of the depot structure or mechanisms. 

3. Propellant depot tankage should be designed with maximum meteoroid 
shield protection commensurate with engineering feasibility and cost 
and penetration depth probability. 

L. A propellant depot attached to an orbiting lunar station should be placed 
between the OIS and the lunar surface in order to lessen the area of de- 
pot exposed to meteoroid strikes. 

5. To prevent the collision of large pieces of debris with an orbiting 
lunar station following a propellant tank explosion, design and emplace 
a grid between the propellant depot and the OLS. The grid should 
shadow the OLS-docked tugs at the end port. 

6. When a propellant depot is attached to an orbiting lunar station, keep 
one tug docked at a transverse port on the side of the OLS away from the 
depot to prevent debris from striking the tug in the event of explosion 
of a propellant tank. 
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HAZARD STUDY lb 

INJURY OR DAMAGE DURING CARGO HANDLING IN ORBIT 


INTRODUCTION 

The delivery of cargo to the lunar space station or to a tug in lunar orbit 
presupposes concern with a number of related problems. These include: 

1 . Guidance and control good enough to keep rates low to avoid collision 
in docking. 

2. The imposition of docking hatch size on cargo packages (modules) to 
be delivered. 

3. Actual delivery mode can include: 

a Entire delivery vehicle docks to receiver 

b Cargo bay is separated from delivery vehicle and then 

docks to receiving vehicle. If the latter, the cargo 
module needs separate propulsion, guidance, and control. 

4. Whether or not the cargo bay arrives at lunar orbit internally 
pressurized. 

Some items such as experiments attached to the space station externally, pro- 
pellant, and tanked and pressurized consumables generally are not brought 
aboard the lunar space station or other spacecraft in lunar orbit. However, 
oxygen for emergency use and some gases associated with experiments, both in 
pressurized tanks, are very likely to be brought on board the lunar space- 
craft. In particular, oxygen tanks to supply the PLSS's as well as the PLSS 
t ank s themselves are highly pressurized. No liquids are likely to be pumped 
aboard the station due to the deterioration of plumbing connection seals when 
corrosive liquids are handled and the subsequent maintenance problems encom- 
passed. Non-corrosive, passive liquids (e.g. , water) are more easily handle- 
by carrying tanks aboard. Because this study is limited to the cargo handling 
itself, a number of assumptions are made -- not intended to represent a final 
system, but only one of many alternatives — to establish a scenario for car- 
go handling in lunar orbit. 
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ASSUMPTIONS 

1 . If cargo is delivered via an unmanned, nuclear prime transport 
vehicle (PTV) then the PTV will stand off from the station 
about five miles and a manned tug will move the cargo module 
from the PTV to the lunar space station. It will be possible 
for a crewman to enter the cargo module to aid in the docking 
procedure at the station. Ref. 1 , 2. 

2. In order not to impose additional burdens on the lunar space 
station all cargo modules arrive pressurized at the level of 
the lunar station. 

3. There are hatches and docking hardware at both ends of the 
cargo modules. Ref. 1, 2. 

4. Cargo module docking ports are compatible with the Earth space 
station as well as the lunar space station; this means port 
diameters permitting passage of a 5-foot diameter cylinder. 

Ref. 1, 2, 3. 

5. Crew members handling docking procedures will have visual 
access to the cargo module during docking (this is based on 
decisions used in the Earth space station studies by North 
American Rockwell, Ref. 3. 

6. When cargo modules and crew modules arrive together on a PTV 
they can be removed by a tug and docked as a unit to the station. 
Then the crew can pass through the cargo nodule into the space 
station. This passage is preferred so as to avoid carrying or 
moving cargo through the crew module and thus exposing crew 
module instrumentation to the possibility of "collision" with 
such cargo. 

7. Cargo handling is accomplished in a shirtsleeve environment. 

Ref. 1, 2, 3. 
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THE MAJOR HAZARD 

The major hazard identified is a cargo container (package) which "escapes” 
while being manually moved from module to station. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of "Escaped” Cargo Package Hazard 

An escaped or improperly handled cargo package being moved within a zero g 
space vehicle may strike and injure a crew member or damage and disable a 
vital subsystem. 

Corrective Measures 


Preventive Measures: 

1 . Except for the size of package that can be comfortably tucked under 
one 1 s arm all cargo containers and packages are best constr ai ned 
during transfer from the cargo module to the space station or to a 
tug. The small package is not likely to be encountered during such 
cargo transfer, (it should be observed, however, that if a cargo 
module is docked at the station and is used in the pantry concept 
many containers are opened in the cargo module for removal of 
relatively small packages - small in size and mass - for transfer 
to the station or tug) . 

2. Assuming that a package is less than 500 lb and has dimensions 
such that: 

a. An astronaut can "peer” around a package to see his 
intended translation path, and 

b. will easily pass through the docking hatch, then the 
package may be handled by one man. 

3. A package less than 1000 lb (but over 500 lb) and less than 
20” x 30” x 40” in dimensions should be handled by two men. 
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4. Packages over 1000 lb (Earth weight) and/or over 20" x 30" x 40" 
in size (for a box-like shape) are best moved using restrain- 
ing systems such as the pallet and rails method described in 
Ref. 1 and 2. A detailed human factors/engineering analysis 

in Ref. 1 is the source of the n umb ers quoted here. 

5. Limit packages to sizes that comfortably pass through the docking 
port - observing that handling hardware must also be emplaced in 
the open port area. 

6. Select techniques of moving cargo packages from their stored 
positions in the cargo module to the module transfer-to- 
station system that ensure package restraint at all times. 

Again, such a system is discussed in Ref. 1 . 

7. For any movement of cargo packages, grasping points are de- 
sired. A generous handhold and adequate clearance to reach 
the grasping point should be ensured. 

No remedial measures have been identified. 

Escape/Rescue Requirements 

None required. 

DATA SOURCES REFERENCES 

1. Unnumbered LMSC Report, "Space Station Program Interim Logistics 
Vehicle Study Report," S. B. Kramer, et al, 9 June 1969; Section 
on Cargo Handling - Part II. 

2. LMSC-A955317, "Integral Launch and Reentry Vehicle (ILRV)," 

31 July 1969; Section 12.1.3 on Cargo Handling. 

3. Space Station Program, Phase B, Definition, Vol. V, MSC-00720, 
NASA NAS 9-9953; North American-Rockwell, July 1970, and Space 
Base Definition, Vol. II, MSC-00712 (part of the Space Station 
Program, Phase B, Definition) North American-Rockwell, July 1970. 
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HAZARD STUDY 14 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. It is strongly recommended that cargo packages whose dimensions 
exceed 20" x 30" x 40" or whose Earth weight exceeds 1000 pounds 
be moved from the cargo module to the lunar space station, or to 
a tug, using a restraint/transport method such as guide rails. 

2. A package whose Earth weight is greater than 500 pounds but less 
than 1000 pounds and whose dimensions do not exceed 20" x 30" x 40" 
should be handled by two crew members when in a zero-g, shirtsleeve 
environment. 

3 . In order for a package to be handled by one man in a zero-g shirtsleeve 
environment, it should: (a) have dimensions permitting comfortable hand- 
ling and vision, and (b) be less than 1,500 pounds Earth weight. 

4. Cargo containers/packages should be designed to provide generous 
grasping points or handholds. 

5. In order to minimize hazards associated with cargo handling in 
orbit, the pantry technique is recommended for receiving cargo. In 
such a method the cargo module is docked to a logistics port at the 
station, cargo is removed on an as-needed basis, the cargo con- 
tainers are opened in the module and the contents removed in separate 
pieces as needed. This technique requires entry to the module on a 
daily (or more frequent) basis but the handling is reduced, in large 
part, to removal of small packages. 


2-100 


LMSC-A984-262C 


HAZARD STUDY 15 

INCORRECT DESCENT OR ASCENT TRAJECTORY OF A MANNED LUNAR LANDER TUG 
INTRODUCTION 

During the course of advanced lunar operations there will be many trips to 
and from lunar orbit and the lunar surface. As time progresses, such expe- 
ditions to the surface are likely to encompass exploration of any location 
on the lunar surface that proves of interest, including the far side. 

On any trip, the possibility exists of a malfunction of navigation equipment 
or data input leading to an unplanned and undesired trajectory. The naviga- 
tion type of malfunction is the sole concern of this Hazard Study with propul- 
sion and control failures discussed in Hazard Study 

ASSUMPTIONS 

1. Two types of trajectories could occur from a navigation malfunction 
during descent to, or ascent from, the lunar surface: 

a. An undesired lunar surface impact trajectory 

b. An unintended orbit about the Moon 

2. No propulsion, control, or communication malfunction has occurred. 

THE MAJOR HAZARDS 

The major hazards are identified as: 

1. A navigation failure or input error has placed a tug on an unplanned 
impact trajectory with the lunar surface. This may or may not be 
evident to the tug crew, but if uncorrected will lead to an unplanned 
landing, to landing at the wrong site, or to a crash. Time available 
for corrective action may vary from seconds to approximately one hour. 

2. A navigation failure or input error has placed a tug in an unplanned, 
non- impact orbit trajectory about the Moon. This may or may not be 
evident to the tug crew, but if uncorrected may lead to isolation. 

Time available for corrective action is on the order of several days. 


2-101 


LMSC-A981+262C 


ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1, Impact Trajectory from Navigation Error 

An unplanned impact trajectory, if not detected and corrected in time, will 
lead to landing at the wrong site or to a crash. Vehicle damage, crew iso- 
lation, and crew injury or death may result. 

Corrective Measures for Hazard 1 

Preventive measures: 

1. The tug guidance subsystem should incorporate backup features and 
redundancy to provide a high degree of reliability. 

2. The tug crewmen must be provided with manual navigation capability 
and trained in manually controlling the tug trajectory at all points 
from orbit to landing and return to orbit. The option to assume 
manual control must be immediately available at all times. 

Remedial measures: 

1. Since the tug crewmen may be unable to detect a navigation error 
within an acceptable time, the tug trajectory on descent and ascent 
should be tracked and status confirmed. 

2. Upon detection of a navigation malfunction or error, standard pro- 
cedure should call for assumption of manual control by the tug crew 
and redirection of the vehicle to a safe orbit. If a landing was 
intended, that landing should be abandoned until the navigation sys- 
tem is returned to proper operating condition. 

Escape/Rescue Requirements for Hazard 1 

If corrective action is not taken, the tug will land or impact at the wrong 
site, with the possibility of tug structural damage and crew injury or death 
resulting. A rescue capability would be required to cover this range of pos- 
sibilities. If outside tracking was not used, and landed crewmen are unable 
to communicate their condition and position, the tug will be extremely diffi- 
cult to locate. A crash locator beacon should be mandatory tug equipment. 
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Effects of Hazard 2, Undesired Lunar Orbit 

An unplanned non-impact trajectory will lead to a safe but undesired orbit 
about the Moon. The tug crew will be isolated until trajectory corrections 
can be accomplished. Since all systems other than navigation are assumed to 
be functioning, and the tug will normally carry life support adequate for 
several days 1 duration, the crew has adequate time for corrective action. 

Corrective Measures for Hazard 2 

Preventive measures for Hazard 2 are identical to those for Hazard 1. 
Remedial Measures: 

With the assistance of Earth tracking, determine the trajectory parameters 
and the corrections required to return to the orbiting lunar station. Use 
manual control, or automatic navigation equipment if repair has been accom- 
plished, to return to the lunar station. 

Escape/Rescue Requirements for Hazard 2 

A crew is in a safe but undesired orbit about the Moon, with navigation 
failed. Escape is not required. Rescue assistance in the form of naviga- 
tion information may be required in order to permit a manually controlled 
return to a lunar station in orbit. If manual navigation capability is not 
provided, a repair/rescue mission will be required. 
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HAZARD STUDY 15 
SUMMARY OF SAFETY GUIDELINES 

1. The crewmen of a lunar lander tug must be provided with manual navi- 
gation capability and must be trained in manually controlling the 

tug trajectory at all points from orbit to landing and return to orbit. 
The option to assume manual control must be immediately available at 
all times. 

2. All lunar lander tug ascent and descent trajectories shall be tracked 
and status confirmed. 

3* Upon detection or notification of a navigation malfunction or trajec- 
tory error , standard procedure shall call for assumption of manual 
control by the tug crew and redirection of the vehicle to a safe 
orbit. 
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HAZARD STUDY 16 

LOSS OF PROPULSION OR CONTROL OF MANNED TUG 
DURING LANDING OR ASCENT TO ORBIT 


INTRODUCTION 

During the procedure of ascent from or descent to the lunar surface, the in- 
terval with main propulsion active is critical. If lunar lander tug pro- 
pulsion fails or attitude control is lost during ascent or descent using some 

of the proposed concepts for the tug, the crew will be lost. 

ASSUMPTIONS 

1 . Main propulsion or attitude control has failed during ascent from or 
descent to the lunar surface. 

2. The crew members are all wearing space suits and are on the LSS suit loop 
during ascent or descent. (This is an aid if a survivable mishap occurs 
wherein the cabin pressure shell is ruptured.) 

3. Lunar surface landing commences from a lunar orbit with a perilune of 
50,000 feet above the mean lunar surface. 

4. Descent insertion commences at an appropriate time before reaching the 
50,000 feet altitude point. 

5. Main engine on at the 50,000 ft point commits the tug to a landing. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1 . If the tug loses attitude control or does not obtain sufficient A V to 
go into a lunar orbit during ascent it will be on an impact trajectory. 

If no further steps are taken, the tug will be destroyed and the crew 
lost in a lunar surface impact. 
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Additionally, in the event of main propulsion failure or loss of attitude 
control after a landing procedure is initiated at 50,000 ft the tug will 
impact the lunar surface and the crew will be lost if no further action 
is initiated. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 , Loss of Propulsion or Control 

If a failure of the tug's main propulsion system occurs during ascent to or 
descent from lunar orbit such that the acquired tug velocity is less than that 
necessary for orbiting or insufficient for landing, then the tug will impact 
the lunar surface. Unless some measure is taken to avoid such an impact the 
crew will be lost. Should attitude control fail during ascent or descent the 
results will be the same, the crew will be lost if the malfunction cannot be 
corrected immediately. 

Corrective Measures for Hazard 1 


Preventive Measures : 

1 . In order to circumvent the dangers inherent in a main propulsion system 
failure, it is suggested that main propulsion consisting of four engines 
be operated as redundant, throttleable pairs j with each pair capable of 
performing the ascent orcfescent function. In this manner a failure in 
any one engine leads to cut-off of its mate whereupon the thrust of the 
second pair is increased to continue the ascent or descent. 

2. Since the main propulsion engines for the tug can be gimballed, it is sug- 
gested that the attitude control engines and main engine gimbal control be 
designed as separable functions. This will permit the main propulsion en- 
gine to supply control for the tug without the use of the primary attitude 
control engines should the latter fail. The tug control loops should be 
designed to use either control mode separately, or to use both sets of en- 
gines acting in concert for control. 
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3. Although the requirement for greatly increased funding is recognized, 
together with the progra mma tic implications, an alternate tug design is 
suggested for consideration as a measure to countermand propulsion failure. 
The tug could be designed as a two stage spacecraft in the manner of the 
Apollo Lunar Module, a major difference being that the ascent (upper) 
stage is only used if the lower stage propulsion (or other critical sub- 
system) fails during ascent (or descent). 

4. Redundancy in all critical main propulsion system parts is suggested so 
that there are at least two propulsion loops per stage to run the tug 
engines. 

Remedial measures: 

1 . For use in events where propulsion failure occurs at very low altitude 
(tens of feet above the surface) an emergency communications device, 
designed to survive severe inpact, should be included in the assemblage 
of instrumentation for use when some of the crew survive the impact or 
to locate the downed tug. 

Escape/Rescue Requirements 

1 . If there has been a propulsion or control failure at a very low altitude - 
tens of feet above the surface — an urgent rescue will be necessary. 

2. Other failures considered here lead to loss of the crew — no requirements 
for rescue exist. 

DATA SOURCE REFERENCES 

1. Apollo 12 Mission Report, NASA/MSC, MSC-01855, March 1970. 
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HAZARD STUDI 1 6 

SUMMARY OP SAEETI GUIDELINES CANDIDATES 


1. The critical nature of lunar lander tug descent and ascent maneuvers de- 
mands special attention to items such as redundancy, backup, manual over- 
ride, propellant reserves, control authority, and anytime -abort where 
feasible, in all critical functions and subsystems associated with control 
of velocity and attitude. 

2. The main propulsion engines for the tugs in the lunar complex should be 
designed as redundant, diametrically located pairs; throttleable, with 
each pair capable of performing the ascent from and descent to the lunar 
surface. 

3. The pilot of a lunar lander tug must be provided the capability to assume 
manual attitude control at any time. 

k. The attitude controls on the tug for the lunar complex should be separable 
so that either main propulsion (i.e. , gimballing engines) or the RCS, or 
both could be used for the attitude control function. 

5. Include as part of standard equipment aboard all lunar complex tugs a 
lunar-impact-survivable communications beacon that would activate on 
impact at some selected acceleration level. In the event of tug impact 
its location could then be determined. 

6. All crewmen shall wear space suits and operate on the LSS suit loop dur- 
ing ascent and descent between lunar orbit and lunar surface. 
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HAZARD STUD? 17 

LOSS OF TUG PROPULSION ON THE LUNAR SURFACE 
INTRODUCTION AND DISCUSSION 

A failure of an ascent propulsion system on the lunar surface will result 
in the temporary isolation of the crew. They will be in danger only if 
they do not have sufficient life support provisions. 

The crew compartment must be provisioned to support the crew for a period of 
time following a planned return to orbit until a rescue mission can be accom- 
plished. Depending on the rescue concept, the emergency stay time require- 
ment is estimated to be 7 to 14 days. This would allow a rescue from orbit 
at a time of minimum energy requirement for the descent and ascent. 

ESCAPE/RESCUE REQUIREMENTS 

Rescue is required for a solo crew isolated in the crew compartment of a 
failed tug on the lunar surface. A wait time of 7 to lh days can be provided 
the crew while the rescue is accomplished. 


* 





SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. A capability must be provided to rescue a crew stranded on the lunar 
surface because of ascent propulsion module failure. 

2. The crew compartment of a solo vehicle on the lunar surface must be 
provisioned to support the crew for a period of time following a 
planned return to orbit until a rescue mission can be accomplished. 
This time is estimated to be 7 to l4 days. 
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HAZARD STUDY 18 

LOSS OF TUG CREW COMPARTMENT HABITABILITY ON THE LUNAR SURFACE 
INTRODUCTION 

The hazards considered are those resulting from a failure of a critical 
subsystem in the crew compartment of a solo lunar lander tug on the lunar 
surface, or from failure of the pressure shell containing the crew. 

ASSUMPTIONS 

1. It is assumed that the lunar lander tug includes a pressurized crew com- 
partment for several men in a shirtsleeve environment, and an attached 
airlock nominally used for egress/ingress. 

2. Loss of habitability can occur at any time during the surface mission, 
and the crew situation at the time of the emergency could typically be: 

a. All crewmen in shirtsleeves inside the cabin. 

b. Some crewmen in shirtsleeves in the cabin and some on EVA sortie up 
to several miles distant on a non-cabin roving vehicle. 

c. Some crewmen in shirtsleeves in the cabin and some are walking EVA 
close to the tug. 

3. The tug crew compartment is provided with contaminant detection and removal 
equipment . 

4- All critical life support system components are highly reliable and have 
redundant parts. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Insufficient time to don space suits following sudden loss of cabin 
atmosphere. It is assumed this could occur only following fire or a 
meteoroid strike, collision, or explosion that ruptured the cabin pressure 
shell. 
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2. Inadequate power and life support supply to allow time for subsystem 
repair, return to a safe haven in lunar orbit, or rescue from orbit. 

3. Illness or incapacitation or deprivation of oxygen following contamina- 
tion of cabin atmosphere. 

4- Injury following explosion or fire with an internal system such as a 
high-pressure gas storage vessel, pyrotechnic, or experimental device. 

5. Isolation of crew members on EVA traverse if the tug must return quickly 
to a safe haven in lunar orbit to save crew members at the tug. 

6. Inability for crewmen to operate the tug and return to orbit in pressure 
suits following loss of cabin atmosphere. 

ANALYSIS OF THE IDENTIFIED HAZARDS 

Effects of Hazard 1 . Insufficient Time to Don Space Suits 

Insufficient time to don space suits following sudden loss of cabin pressure 

will result in loss of the crew unless an emergency compartment or emergency 

pressure garment is readily available. 

Corrective Measures for Hazard 1 

Preventive measures: 

1. Provide two separate pressure compartments in each tug crew compartment, 
with quick access from one to the other and with pressure suits (or 
emergency pressure garments) and PLSS's stored in each. The second 
compartment could be an airlock, with generous dimensions and emergency 
life support. 

2. Provide emergency pressure garments which can be donned more quickly 
than pressure suits. Atmosphere supply for the garments should be 
two-gas, if the cabin is two-gas. 

3. Keep crewmen in pressure suits at all times, assuming a backup pressurized 
compartment or emergency pressure garments are not readily available. 
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No remedial measures are identified for Hazard 1. 

No escape/rescue requirements are identified for Hazard 1. 

Effects of Hazard 2 . Inadequate Power and Life Support Supply 

Insufficient emergency power and life support supply to allow subsystem re- 
pair, return to station in orbit, or rescue from orbit will result in loss 
of the crew following failure of a vital tug subsystem. 

Corrective Measures for Hazard 2 

Preventive measures : 

1. Plan each mission sequence such that emergency supplies are always avail- 
able to allow time for return to safe haven in orbit or rescue from 
orbit, whichever is greater. Preliminary analysis indicates this time is 
on the order of 48 hours in the worst case. 

2. Use two tugs for each surface mission such that a backup system is always 
available . 

3. Provide capability for operation and return of the tug to orbit by crew- 
men in pressure suits. 

Remedial measures: 

1. Provide a "care" package from lunar orbit, if this can be accomplished 
more quickly than rescue or escape to orbit. 

No escape/rescue requirements are identified for Hazard 2. 

Effects of Hazard 3 . Impairment following Contamination 

Contamination of cabin atmosphere will result in illness, incapacitation, or 
deprivation of oxygen if corrective action is not taken. 
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Corrective Measures for Hazard 3 


Preventive measures: 

1. Provide oxygen masks, emergency pressure garments and/or pressure suits, 
or separate pressure compartment and ECS, and immediate use of one of 
these, following detection of contaminants. 

2. Monitor cabin atmosphere to detect contamination and initiate corrective 
action before illness, incapacitation, or oxygen deprivation can occur. 

Remedial measures: 

1. Don space suits and return to a safe haven in lunar orbit if contamination 
cannot be removed. 

2. Crewmen suffering from breathing contaminated atmosphere must be provided 
clean air, a safe haven, and medical aid. 

Escape/Rescue Requirements for Hazard 3 

Rescue will be required if corrective measures are not taken to prevent illness 
or incapacitation. 

Effects of Hazard A . Explosion or Fire 

An explosion or fire with an internal system such as a high-pressure gas 
storage vessel, pyrotechnic, or experimental device may damage vital sub- 
systems, rupture cabin walls, and injure or kill crewmen. 

Corrective Measures for Hazard 4 

Preventive measures: 

1. The use of hazardous items should be minimized or eliminated by substi- 
tution where possible. Where such items are high-pressure gas storage 
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bottles, pyrotechnics, and hazardous experimental devices must be car- 
ried, they should be separated from the main cabin and from critical 
subsystem components by enclosing in vented compartments and structures 
designed to contain an explosion or fire. 

2. Explosions in gas storage bottles should be prevented by reliable re- 
lief valves and by monitoring to provide warning of excessive pressures, 
plus use of manual procedures to vent a malfunctioning bottle. 

3 . Achieve reliability and safety by use of adequate safety factors (burst 
to operating pressure) in pressure vessel fabrication. 



Remedial Measures: 


1 . In the event of fire or explosion, it should be possible to seal quickly 
each pressurized compartment separately, and then remotely exhaust the 
atmosphere of the compartment containing the fire or explosion. (See Page 2-26) 


2 . 


Fire extinguishers 
of manned vehicles. 


should be provided in each pressurized compartment 


3 . Oxygen masks and emergency pressure garments should be available in each 
pressurized compartment. 


Escape/Rescue Requirements for Hazard 4 

Escape and rescue will be required in the event of fire or explosion in a 

tug crew compartment on the lunar surface. ± 


Effects of Hazard 5 , Isolation of Crew Members on EVA Traverse 

If the crew members in a tug on the lunar surface must return to orbit quickly 
for their own safety, they may have abandoned crew members away from the land- 
ing site on traverse. The crewmen on traverse will be isolated, with a limited 
life support stay time capability, and will require rescue from lunar orbit. 
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Onri-ft fft.i ve Measures for Hazard 5 
Preventive measures: 

1. All crew members on EVA should return to the tug without delay following 
notification of an emergency at the tug. This will minimize time delay 
in returning to orbit, if this action is chosen, and require only one set 
of rescue operations should rescue be necessary. 

2. Emergency life support duration capability on board the lander tug should 
always exceed the time required for return of all crewmen to the tug plus 
return to a safe haven in lunar orbit. This capability must be estab- 
lished uniquely for each mission. 

3. Use of two tugs for each surface mission such that a backup system is 
always available. 

Remedial measures: 

1. Provide life support and other necessities with the EVA crew on traverse 
calculated to assure a safe stay time exceeding rescue time. Perform a 
rescue mission. 

Escape/Rescue Requirements for Hazard 5 

Rescue will be required for crewmen abandoned while on traverse away from 
the lander tug. 

Effects of Hazard 6 . Inability to Fly the Tug in Pressure Suits 

Inability to fly the tug and return to orbit in pressure suits, following 
loss of cabin atmosphere, will leave the crew stranded on the lunar surface 
to await rescue. 
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Corrective Measures for Hazard 6 
Preventive measures: 

Provide capability for operation and return of the tug to orbit by crewmen 
in pressure suits. 

No remedial measures are identified for Hazard 6. 

Escape/Rescue Requirements for Hazard 6 

Rescue will be urgently required if crewmen are unable to fly the tug in 
pressure suits. 
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HAZARD STUDY 18 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 


1. Each lunar lander tug shall be provided with two separate pressure compart- 
ments, with quick access from one to the other and with pressure suits (or 
emergency pressure garments) and FLSS's stored in each. 

2. Each lunar lander tug shall be provided with emergency pressure garments 
which can be donned more quickly than full pressure suits. 

3. Crewmen in a solo lunar lander tug on the lunar surface shall remain in 
pressure suits at all times if quickly accessible separate pressure 
compartments and emergency pressure garments cannot be provided. 

4. The lunar lander tug must be flyable by crew members in pressurized space 
suits. 

5. No subsystem failure in a lunar lander tug crew compartment shall deprive 
the crew of the ability to perform at least one of the following actions: 

a. Replace or repair the failed article. 

b. Return to a safe haven in orbit. 

c . Await re scue . 

6. A rescue vehicle should be standing by in lunar orbit at all times during 
a solo lunar lander tug mission on the lunar surface. 

7. Cabin atmosphere shall be monitored continuously to detect contamination, 
and immediate action taken to use either oxygen masks, emergency pressure 
garments, pressure suits, or separate pressure compartment and ECS as 
appropriate if contaminants are present. 

8. Oxygen masks, emergency pressure garments, and pressure suits shall be 
provided for use following detection of contaminants in cabin atmosphere. 
Availability of a second, separate pressurized compartment and ECS is 
also recommended. 

9. Standard operating procedures shall require that crew members, on EVA 
traverse from a solo lunar lander tug, return to base without delay 
following notification of an emergency at the tug. 
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10. Emergency life support capability on board a solo lunar lander tug shall 
always exceed the time required for return of all crewmen to the tug plus 
return to a safe haven in lunar orbit. This capability must be established 
uniquely for each mission. 

11. Each EVA crew on traverse shall be provided with life support and other 
necessities calculated to assure a safe stay time exceeding rescue time. 

12. High-pressure gas storage bottles, pyrotechnics, and hazardous experimental 
devices shall be separated from the main cabin and from critical subsystem- 
components by enclosing in compartments vented to space and structures de- 
signed to help control an explosion or fire. 

13. Pressures in high-pressure storage vessels shall be monitored to provide 
warning of an impending explosion, and procedures shall be developed to 
correct potential hazards so detected. 

14 . Provision should be made for quickly sealing each pressurized compartment 
separately and then remotely exhausting the atmosphere to extinguish a 
fire. (See note Page 2 - 26 ) 

15. Fire extinguishers shall be provided in each pressurized compartment of 
manned vehicles. 


2-118 



LMSC-A984262C 


HAZARD STUDY 19 

LOSS OF LUNAR SURFACE BASE (LSB) HABITABILITY DURING OCCUPANCY 
INTRODUCTION 

The lunar surface base will provide living and working facilities on the 
lunar surface for scientists and engineers conducting a wide variety of 
tasks over an extended period of time, and will provide support for lunar 
surface expeditions (Ref. l). 

This study analyzes hazards associated with a lunar surface base (LSB) that 
becomes functionally inoperable or uninhabitable either before or at the 
time of initial manning, or while manned. 

ASSUMPTIONS 

1. A lunar surface base has previously been taken to the lunar surface 
unmanned. 

2. One or more fully operable lunar lander tugs with crew compartments 
are required to be at the surface base site at all times when the 
base is manned. The surface-based tugs provide alternate shelter 
capability, escape capability, and transportation to an orbiting lu- 
nar station for normal and emergency transport requirements (Ref. 2). 

3. Access to the LSB crew compartment from the lunar surface will require 
an elevator, long ladder, or ramp. 

1. Crew compartments are provided with contaminant detection and removal 

equipment. 

5 . All critical life support system components are highly reliable and 
have redundant parts. 

6. The internal design, functions, and safety of the LSB are the concern 
of other studies, and are not examined here. 
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THE MAJOR HAZARDS 

The major hazards identified are: 

1. Insufficient time to don space suits or escape to an adjacent, safe 
compartment following sudden loss of cabin atmosphere. It is assumed 
this could happen only following a meteoroid strike, collision, or 
explosion that ruptured the cabin pressure shell. 

2. Inadequate backup or emergency power and life support supply to allow 
time for subsystem repair, transfer to a nearby safe haven, or to 
await arrival of a rescue crew. 

3. Illness or incapacitation or deprivation of oxygen following contami- 
nation of cabin atmosphere. 

k. Injury following explosion or fire with an internal system such as a 
high-pressure gas storage vessel, pyrotechnic, or experimental 
device. 

5 . Loss Of access from base to surface, or surface to base following 
damage to elevator, ladder, or ramp. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 , Insufficient Time to Don Space Suits 

Insufficient time to don pressure suits or escape to an adjacent, safe com- 
partment following sudden loss of cabin pressure will result in loss of the 

crew. 

Corrective Measures for Hazard 1 

Preventive measures: 

l. Escape to a separate pressurized compartment could normally be accom- 
plished much more quickly than donning of a pressure suit. Action 
must be completed before cabin pressure drops to 1.7 psia (Ref. 3)* 
Thus it is advisable to have multiple pressurized compartments avail- 
able, with interconnecting passageway or airlock hatches open at all 
times but quickly sealable. According to Ref. 1, the LSB is to con- 
tain a separate compartment for survival in case of primary compart- 
ment failure. 
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The corapartment(s) selected must have the capability to provide a 
safe haven for all crew members present until one of the following 
can be accomplished: 

a. The base failure can be corrected 

b. The crewmen can move to the shelter of a lunar lander Tug crew 
compartment. 

2. Provision of an emergency pressure garment that could be donned much 
more quickly than a full pressure suit would enhance the ability of 
a crewman to safely make repairs or reach a safe haven. This garment 
might be constructed of nylon or dacron polymer impregnated material 
which could be stored under inert conditions in a flat aluminum con- 
tainer with "rip-out" sealcovers. The emergency suit would be designed 
to operate directly off either the primary base atmosphere supply or 
bottled supply of the same gas mixture. 

No remedial measures are identified for Hazard 1 

Escape/Rescue Requirements for Hazard 1 

Escape to a safe haven will be required, but there should be no need for rescue. 

Effects of Hazard 2 , Inadequate Power and Life Support Sunnly 

Inadequate backup or emergency power and life support supply to allow time 
for subsystem repair, transfer to a nearby safe haven, or to await arrival 
of rescue assistance will result in loss of the crew following failure of a 
vital station subsystem. 

Corrective Measures for Hazar d 2 
Preventive measures: 

Each mission sequence must be planned such that a backup or emergency source 
of power, life support, and communication capability will be available at all 
times so that following loss of primary source, the crew can proceed to a 
safe haven unassisted or await rescue, whichever time is greater. It is as- 
sumed that lunar lander tugs, stationed 1 to 1^2 nm from the IBB, will always 
be available as a safe haven. j 

No remedial measures are identified for Hazard 2. 
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Escape/Rescue Requirements for Hazard 2 

Rescue of a crew in a lunar surface "base with inadequate power and life sup- 
port supplies may "be required if lunar lander tugs are not standing by as 
safe havens. 

Effects of Hazard 3 > Impairment following Contamination 

■ ■ ■ -■ ■ 

Contamination of cabin atmosphere will result in illness, incapacitation, or 
deprivation of oxygen if corrective action is not taken. 

Corrective Measures for Hazard 3 

Preventive measures: 

1. Provision of oxygen mask, emergency pressure garments and/or pressure 
suits, or separate pressure compartment and ECS, and immediate use of 
one of these, following detection of contaminants. 

2. Monitoring of cabin atmosphere to detect contamination and initiate 
corrective action before illness, incapacitation, or oxygen depriva- 
tion can occur. 

Remedial measures: 

1. Outside assistance, or temporary abandonment of the station may be 
required if contamination cannot be removed. 

2. Crewmen suffering from breathing contaminated atmosphere must be pro- 
vided clean air, a safe haven, and medical aid. 

Escape/Rescue Requirements for Hazard 3 

Rescue will be required if corrective measures are not taken to prevent ill- 
ness or incapacitation from contamination. 

Effects of Hazard 4, Explosion or Fire 

An explosion or fire may have hazardous effects similar to Hazards 1 and 3, 
plus the following: 

1. High-pressure gas storage bottles, pyrotechnics, and hazardous expert 

mental devices should be separated from the main cabin and from vital 
subsystems components by structures designed to contain an explosion 


or fire. 


2-122 


LMSC-A984262C 


2. Pressures in high-pressure storage vessels should be monitored to 
provide explosion warning, and procedures developed to correct poten- 
tial hazards. 

3. Where multiple pressure compartments are provided in a system, crew 
members should not all occupy one compartment at one time. 

4. Provision should be made in station design for sealing each pressur- 
ized compartment separately and then exhausting the atmosphere to 
extinguish a fire. 

5. Fire extinguishers should be provided in each pressurized compartment. 
Remedial measures: 

Crewmen injured by explosion or fire will require immediate medical assistance, 
provision of pure atmosphere, and removal to a safe haven. 

Escape/Rescue Requirements for Hazard 4 

A crewman injured by fire or explosion must escape or be rescued and provided 
a safe haven and medical aid. Removal to Earth may be necessary for adequate 
treatment. 

Effects of Hazard Loss of Access between Surface and Base 

Loss of access from base to surface, or surface to base, could result in en- 
trapment of base crewmen, denial of access to base crewmen for assistance or 
rescue, and denial of a safe haven to EVA personnel returning to the base. 

Corrective Measures for Hazard 5 

Preventive measures: 

The lunar surface base should be provided with alternate access ports and 
alternate access/escape routes. Alternate means for transporting incapaci- 
tated crewmen both from surface to base and from base to surface should be 
provided. 

Wo remedial measures are identified for Hazard 5. 

Escape/Rescue Requirements for Hazard 5 
Wo escape or rescue requirements are identified. 
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HAZARD STUDI 19 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. Provision shall be made to remotely activate and check out a lunar 
surface base which has been taken to the lunar surface by an unmanned 
lunar landing tug. 

2 . A crew sent to activate a defective unmanned lunar surface base shall 
be provided with pressure suits and FLSS units, repair parts and tools, 
portable battery powered lights, and specific procedures for inspec- 
tion and repair. 

3 . Each lunar surface base shall have more than one pressurized compart- 
ment capable of supporting the crew. Hatches to interconnecting pas- 
sageways or airlocks shall be kept open at all times, but be quickly 
sealable in an emergency. 

k. Each lunar surface base shall have parked near the site space tug vehi- 

cles with crew compartments, propulsion modules, and instrument units capa- 
ble of housing and supporting the entire base crew and escaping to orbit. 

5 . Each lunar surface base mission sequence shall be planned such that a 
backup or emergency source of power, life support, and communication 
capability is available at all times so that following loss of a pri- 
mary source, the crew can proceed to a safe haven unassisted or await 
rescue, whichever time is greater. 

6. Cabin atmosphere in a lunar surface base shall be monitored at all 
times to detect contaminants and permit corrective action to be taken 
before illness, incapacitation, or oxygen deprivation can occur. 

7. Each lunar surface base shall provide oxygen masks and emergency 
pressure garments at each crew station, pressure suits and PLSS units 
for each crew member, and immediate use of these or escape to a separ- 
ate compartment following detection of contaminants in the atmosphere. 


2-125 


LMSC-A984262C 


8. High-pressure gas storage bottles, pyrotechnics, and hazardous experi- 
mental devices shall he separated from the main cabin of a lunar sur- 
face base, and from critical subsystems components by enclosing in 
compartments vented to space, and in structures designed to help con- 
trol explosion or fire. 

9. Pressures in high-pressure storage vessels shall be monitored to pro- 
vide warning of an impending explosion, and procedures shall be devel- 
oped to correct potential hazards so detected. 

10. Where multiple pressure compartments are provided in a system, crew 
members shall not all occupy one compartment at one time. 

11. Provision shall be made in lunar surface base design for quickly seal- 
ing each pressurized compartment separately, and then exhausting the 
atmosphere to extinguish a fire. ^See Note Page 2-26) 

12. Fire extinguishers shall be provided in each pressurized compartment 
of manned vehicles. 

13. Each lunar surface base shall be provided with alternate access ports, 
alternate access/escape routes, and alternate means for transporting 
incapacitated crewmen from surface to base, and from base to surface. 

14. Careful attention should be given to the use of non-flammable materials 
in the lunar surface base design, and the atmosphere provided should be 
two-gas. Hazardous materials should be handled in a specially desig- 
nated area. 





I 
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HAZARD STUD! 20 

STUD! OF OPERATIONS IN AND AROUND THE HJNAR SURFACE BASE 
INTRODUCTION 

A lunar surface base constitutes a complex system having a large number of 
interactions analogous to a multi-loop feedback system. Activities that will 
occur in the establishment and operation of a lunar base will commence with 
delivery of site -preparation vehicles and materials, and will be followed by 
delivery, unloading, and location of the lunar base modules. Initial start-up 
and checkout of base systems will then occur through use of an umbilical, for 
example, connected to a tug on the surface acting as a temporary shelter for 
the initial crew. The crew will then begin lunar operations and conduct sci- 
entific and engineering studies as scheduled in the mission program. These 
activities will encompass base and vehicle (e.g. , the rovers) ingress/egress 
procedures, layout of instrumentation - typified by setting up radio astron- 
omy and X-ray telescopes - and a variety of rover and lunar flyer traverses 
to remote sites for exploratory purposes. 

A nuclear reactor may be chosen for the generation of electrical power. The 
SNAP 8 system, supplying a nominal 35 kw of electrical power, is a likely 
initial candidate for this function. This study will assess the impact, from 
the potential hazards viewpoint, to the manned lunar mission of the presence 
of such a nuclear power system. 

ASSUMPTIONS 

1. From an orbiting lunar space station a crew will descend to the lunar 
surface in a tug and complete site preparation at the selected loca- 
tion for the lunar surface base. 

2. The nuclear reactor power plant will arrive at lunar orbit and be 
delivered to the surface base area, prepared for operation and kept 
in a quiescent state until the lunar base modules have arrived and 
are set up, ready for checkout. 

3. Auxiliary vehicles such as the rovers and flyers will arrive as sched- 
uled in the NASA mission plans. 
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THE MAJOR HAZARDS 

The major hazards identified are: 

1. Damage to personnel shelters (i.e., the base) and injury to crew 
members by ejecta thrown up by the engine plumes of the tug as it 
nears the lunar surface. 

2 . Module handling leading to tip-over and injury or damage during 
arrival and location of lunar base modules. 

3. Accident while handling and setting up large structures for research 
purposes while in an EVA mode. 

k. Fire in a lunar surface base. 

5« Release of fission products from the reactor after sustained full 
power operation. 

ANALYSIS OF IDENTIFIED HAZARDS 
Effects of Hazard 1 , Damage from Ejecta 

Tug rocket engine plumes will impinge on the lunar surface during landing or 
liftoff and give rise to ejecta from the surface which, in turn, could strike 
lunar vehicles parked nearby, the lunar base, or crew members in an EVA mode. 
Such strikes could injure EVA crew members and/or damage the base, thus im- 
periling life support for the crew. 

Corrective Measures for Hazard 1 

Preventive measures: 

l. Locate tug landing areas away from the ISB, the optimum distance to be 
determined by study. Current studies suggest 1 to 1V2 nautical miles. 

2 . Prepare landing sites for the tugs at lunar surface base sites so as 
to prevent ejecta before and at touchdown or liftoff. 

3. Forbid EVA activity near the base during tug landings or departures. 

No remedial measures are identified for Hazard 1 . 

Escape/Rescue Requirements for Hazard 1 
None are identified. 
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Recommendations for Further Study 

It is recommended that studies he conducted to determine the optimum dis- 
tance that tug landing areas should he located with respect to the LSB. 
Additionally, techniques should he evolved for assuring that there are no 
lunar ejecta due to plume impingement whenever tugs land or depart. That is, 
a method of preparing a permanent landing pad should he evolved. Mi nim um 
landing distance should then he a function of landing pad preparation. 

Effects of Hazard 2 , Module Tip-over 

At least one mode of providing an LSB involves the "assembly"’ of a group of 
modules landed on the lunar surface. These modules would have to he moved 
to a common location, and this would he unnecessarily difficult if done un- 
manned. Some sort of rover would have to be used, and as a consequence the 
procedures of loading the modules, moving them to a selected location, and 
unloading them would present the potential' hazard of tipping over and causing 
injury or death to one or more crew members. Tipping over could result from 
making too sharp a turn, striking and attempting to ride over a large rock, 
entrapping a wheel in a small crater, or from wheel or rover structural failure. 

If the IBB is brought to the surface in a single unit, there still remains 
the task of locating and erecting scientific equipment, some of which is 
physically large and heavy, such as radio astronomy and X-Ray and optical 
telescopes. The modules for this equipment will also require location at 
specific sites other than their respective landing sites. The potential 
hazard noted above will exist in these cases also. 

Corrective Measures for Hazard 2 

Preventive measures: 

1. The movement of modules once loaded aboard a "rover" could he conducted 
remotely by crew members traveling with, hut not close to or aboard, 
the module carriers. The crew members could ride a separate rover far 
enough from the module to avoid it completely in case of tip-over, but 
close enough (i.e., leading it) to guide it around hazards. 
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2. Modules landed already emplaced on a rover would avoid loading on the 
Maon and would reduce the task to unloading only. If the modules 
arrive mounted on the chassis of a tracked or wheeled vehicle, thep. 
they can he driven to the set-up location and connected as required. 
Differential ground heights can he adjusted through the use of jacks 
which are mechanically fixed after adjustments to accommodate module 
connection at the final site for the ISB. 

Remedial measures: 

If a module tips over and strikes a crewman, he will he injured and will need 
a rover vehicle and stretcher to bring him to a safe haven where his injuries 
can he treated. If he is pinned beneath the module, a winch and cable com- 
bination or similar mechanism will he required to free him. 

Escape/Rescue Requirements for Hazard 2 

Should a module or other large piece of equipment tip over during its move- 
ment to an operational site and injure or pin a crew member to the surface, 
rescue will he necessary. 

Effects of Hazard 3 , Accident while Setting up Large Structures 

The problems involved in setting up large structures for research purposes 
while in an EVA mode are essentially the same as those in Hazard 2, with the 
additional problem of avoiding entanglement with large structures like anten- 
nas (whether Yagi-type,or dish wide-mesh type, or multiple helices), or large 
solar arrays, or with wiring assemblies that form complex arrangements on the 
surface, or close enough to the surface to pose the entanglement hazard. 

Corrective Measures for Hazard 3 

Preventive measures: 

1. All of the preventive measures of Hazard 2 apply. 

2. Operations in setting up complex structural networks such as antennas 
should be designed so as to avoid having a crew member work (with his 
PLSS or other devices attached to him) in a back-to-back mode in order 
to avoid physical entanglement. 
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3 . Laying out cable or wiring on the lunar surface in concert with set- 
ting up equipment should "be accomplished so as to avoid foot entangle- 
ment. This may he done hy burying cables or wires , by laying equip- 
ment and attached wires in a straight line or other pattern which 
avoids any but simple crossing (of the cable, etc. ) during set-up/ 
conduct of the experiment, or by stringing wires on poles. 

4. Working in (at least) pairs, fellow astronauts can avoid entanglements 
by carrying equipment, cables, wiring between them, and so avoid drap- 
ing these over one man with the inherent possibilities of becoming en- 
snared. 

5» When working at substantial distances from the LSB, a small shelter 
with supplies and first aid equipment should be available on site. 

This shelter could be a cabin rover. 

Remedial measures: 

Complex structures should be moved and set up by astronauts working in groups, 
at least in pairs - the buddy system - in order that aid will be immediately 
available in the event of a mishap. 

Escape/Rescue Requirements for Hazard 3 

An astronaut entangled in cabling, wiring, or complex structure may need aid 
to free him. 

Effects of Hazard 4 , Fire 

During the course of conducting experiments, or of performing maintenance/repair 
functions in the lunar surface base, inadvertent crossing of wires, short cir- 
cuits, accidental mixing of hypergolic chemicals, inadvertent detonation of 
pyrotechnics, and similar incidents might lead to a fire. 

A fire in the I£B is very serious since a fire of any consequence will leave 
little time for remedial action before the affected compartment(s) is heavily 
involved. The effects of a fire include injury or death of crew members, de- 
struction of equipment vital to the life support of crew members, and failure 
of the pressure shell of the compartment, thus exposing the crew to the vacuum 
and a severe temperature decrease in the affected compartment. 
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Corrective Measures for Hazard b 

Preventive measures: 

1. Very severe requirements for non-combustibility of materials used in 

constructing the IBB should be imposed to the maximum extent possible. 

2. To the maximum extent practical: 

a. Relegate all handling and storage of hypergolic chemical com- 
binations to a separate lunar shelter, or rule them out of use 
in the IBB altogether. 

b. Minimize handling and use of pyrotechnic devices inside the IBB. 

c. Use "trays" to carry wiring and cables totally separated from 
traffic so as to minimize damage by collision, entanglement, 
wetting by chemicals, etc. 

d. Use a two-gas atmosphere, oxygen and nitrogen, so as to have a 
heat-absorbing diluent. 

e. In order to avoid the need for soldering wiring, all wire con- 
nections should be arranged through the use of fasteners. This 
general philosophy should be applied throughout the IBB to con- 
necting plumbing, structures, etc. 

f. Fluids used in the LSB cooling system should be totally non- 
combustible, even in pure oxygen. 

g. Smoking by any personnel should be completely forbidden. 

h. If propellants are stored on the lunar surface, they should be 
kept well removed from the IBB so that an accident (explosion, 
etc.) involving the stored propellants does not propagate to the 
base. 

Remedial measures: 

1. The IBB should be designed so that it is divided into two or more 

isolatable compartments. An optimum distribution of space suits and 
portable oxygen masks should be determined. Then compartments involved 
in fire can be vented or flooded with nitrogen (or CO^ stored from meta- 
bolic waste) while the crew takes refuge in a safe compartment and 
attempts to control the fire and damage from this safe area. 

(See note Page 2 - 26 ) 
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2. A compartment involved with fire could “be flooded with nitrogen and 
simultaneously vented while keeping pressure at some specified level. 
This can he done with the crew wearing portable oxygen masks. 

3* Development of special fire extinguishers which would minimize or 
have zero contaminants resulting from use of such an extinguisher 
is recommended. 

Escape/Rescue Requirements for Hazard 4 

1. The crew of an IBB damaged by fire can leave it and return to lunar 
orbit via a tug which is parked nearby on the lunar surface. 

2. If crew members are in a closed isolated compartment without direct 
access to the outside (i.e., without passing through the fire-involved 
compartment) they will have to be rescued. 

3« If the IBB has a fire, EVA astronauts will either be able to go to a 
parked tug or, if they are needed, assist in extinguishing the fire 
and aiding crewmen in the base. 

4. Astronauts out on a rover or flyer traverse will have to be informed 
of the fire; they then may: 

a. Return (if they are close by) to fight the fire and render 
assistance 

b. Return to the IBB and take the tug to lunar orbit. 

c. Agree to rendezvous at some selected point for rescue. 

Effects of Hazard 5 , Nuclear Radiation 

A lunar surface base may draw primary electrical power from a nuclear power 
supply. The most severe nuclear power accident source which might be con- 
sidered credible is the release of fission products from the reactor-shield 
assembly after sustained, full-power operation (Ref. l). Such an event might 
be initiated by a leak in the primary NaK loop which would result in EaK 
boiloff. This could cause partial - and perhaps complete - meltdown of the 
core due to afterheat generation. This would lead to fission products escap- 
ing from the power plant. It is believed reasonable to expect that most of 
the fission products would be confined to the immediate location of the power 
plant. 
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The consequences of the postulated accident have "been estimated, based on 
occurrence after one year of sustained operation at a thermal power of 400 kw. 
The gamma ray source strength data were obtained from additional references 
given in Ref. 1, and the separation distance required to limit the integrated 
dose to 50 REM in a l4-day period was calculated for various degrees of fission 
product release. The results are given in Table X. 


Table I 

Postulated Accident Occurrence (Ref . l) 

Case Separation distance req'd l4-day dose 

for 30 REM in l4 days (ft) at 200 ft feiEM ) 


All fission products released 
from shield, but contained 
with vehicle that landed the 
power plant 

2,000 

50 

Only gaseous fission products 
released from shield, but con- 
tained within landed vehicle 

900 

10 

All fission products released, 
but contained within shield 

900 

10 

Only gaseous fission products 
released, but contained within 
shield 

4oo 

2 


The information in Table I is sufficient to indicate that only lack of know- 
ledge of the nuclear accident would endanger any member of the LSB crew to 
any substantial degree, since he could conceivably walk into the irradiated 
area. 

A consequence as serious as irradiation is the loss of electrical power for 
the LSB in the event of power source failure. The loss of many functions 
will occur if power fails. Such a loss could place the LSB crew in jeopardy 
because of the cascading effects on life support, communications, and other 
subsystems . 
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Corrective Measures for Hazard 5 

Preventive measures: 

1. A series of strategically placed counters and dosimeters (for gammas, 
neutrons, and other possible particles) in an alarm circuit would 
provide a constant warning system for the LSB so that radiation levels 
just outside the nuclear power plant, and at selected distances from 
it, could constantly be monitored and the crew warned of hazardous 
conditions. 

2. Delivery of the power plant as a unit permanently emplaced in a land- 
ing vehicle and landed inside a designated crater is suggested as a 
delivery mode to minimize hazards in both delivery and operation. 
Alternately , a scraper blade on a large lunar rover could cut out a 
ramp to a designated crater, and the palletized or skid-mounted power- 
plant-in-vehicle could be towed down the ramp into the selected crater; 
the breached crater wall would later be reconstructed before reactor 
start-ups. Reference 1 states that a power plant emplaced on a lunar 
landing vehicle can be designed so that only minor tasks remain before 
startup of the reactor. The emplacement in a crater reduces the radi- 
ation hazard to the crew of the IBB to a great degree. 

3« In order that the crew not be faced with the consequences and hazard 
of no electrical power in the event of power plant failure, a tug 
should be parked near the IBB for evacuation and return of the crew 
to the lunar space station. 

4. An alternate to Wo. 3* above, is the provision of secondary (emergency) 
power sources usable until primary power is restored. The provision 
of such second sources should be a certainty. 

5. Another alternative, whose study ought to be considered, is the pro- 
vision of not one, but two nuclear power plants for the IBB. If used, 
these should be widely separated, and each run at half-power, whereupon 
the immediate availability of one is at hand should the other malfunc- 
tion. The costs implied, as well as the inherent advantages of such 

a system, must be considered. 
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Remedial measures: 

1. Remedial measures for serious radiation exposure probably implies 
return to Earth for treatment, whereas minor exposure is likely to 
be treated at the I£>B or at the lunar space station. 

2. Repair of a malfunctioned nuclear power source is discussed at length 
in Reference 1. Suffice it to state here that, at least in the early 
years of operation, capability for repairs will be rather limited. 

ADDITIONAL INFORMATION 

Some ideas on lunar surface base configuration that improve safety are pre- 
sented in Appendix E, Supplemental Data Report No. 3* 

SOURCE DATA REFERENCES 

1. Design Requirements for Reactor Power System for Lunar Exploration} 
LMSC/677879, Vol. II, LMSC, Sunnyvale, Calif., September 1967 

2. Space Tug, Logistic Vehicle Parameters; North American Rockwell, 
70MA5828, July 1970, pp 19 - 27 

3 . Lunar Base Synthesis Study - First Interim Progress Report; North 
American Rockwell, October 1970 

4. Lunar Staytime Extension Module; Goodyear Aerospace Co. , GER- 12246 

5. Internal Memo: NASA Headquarters, Gangler to Goldberg, October 1966 

6 . LESA Deployment Procedures, LMSC/A 665606 ; LMSC, Sunnyvale, Calif. 
February 1965 
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HAZARD STUDZ 20 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Landing pads should be prepared for tugs visiting a lunar surface base 
at the earliest possible time after initiating IBB activity. 

2. The movement of large pieces of equipment, or of modules, on the lunar 
surface should be accomplished with the astronaut nearby and guiding 
and controlling such movement, but not aboard the carrying vehicle. 
Thus, in the event of module transport vehicle upset, tip-over, etc., 
he will not be trapped or injured. 

3. The buddy system, or presence of a safety man, should be used in set- 
ting up large equipment on the lunar surface, so that EVA astronaut 
entanglement (e.g. , wires) is minimized as a hazard, and so that im- 
mediate aid is available if needed. 

4. Very severe requirements for use of non-flammable materials used in 
lunar surface base construction should be observed. 

5. Enough tugs should always be available at a lunar surface base to 
evacuate the entire crew to lunar orbit should the LSB have to be 
abandoned. 

6. The following items are forbidden in, or very close to, the LSB: 

a. handling or storage of hypergolic fluids 

b. handling or storage of pyrotechnic devices 

c. combustible fluids in the thermal control system 

d. dangerous chemicals 

e. bacteriological experiments 

7» A fire extinguishing system should be designed to flood any fire-in- 
volved compartment with nitrogen or other non-combustible gas. A 
fail-closed vent system should be used in concert with the fire ex- 
tinguishing system to rid an involved compartment of contaminants. 

8. Space suits and PISS's should be readily available at strategic 
locations in the LSB for use in emergencies. 
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9. Crew smoking shall he prohibited at all times on lunar missions. 

10. A nuclear power source used to generate electrical power shall he 
stationed at least 2,000 feet from the IBB — preferably in a crater 
whose walls are higher than the reactor container, and that have been 
thickened by moving soil. 

11. Secondary power sources should be available for the IBB in the event 
of nuclear source malfunction. Such secondary sources should be 
adequate to maintain all life support and essential communications 
functions until repairs are made, or rescue or return to orbit effected. 

12. Life support umbilicals for oxygen, communications, power, contaminant 
and thermal control, etc. , shall be provided at selected areas of the 
exterior of the LSB. These shall be adequately marked and lighted at 
night. Moreover, an internal display panel shall indicate actual use 
of each such umbilical. 

13. It is recommended that the IBB have provisions to permit shirtsleeve 
transfer to and from the cabin rover. 

14. The airlocks, doors, hatches, elevators, etc., for the IBB shall be 
large enough to accommodate at least one stretcher case , plus one 
crewman wearing a total EVA mobility unit. 
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HAZARD STUDY 21 

ACCIDENT OR IMPAIRMENT TO A ROVING VEHICLE 


INTRODUCTION 

Major saf ety concerns associated with lunar surface operations occur as a 
result of hazards imposed by critical roving vehicle subsystem failures. 

Major subsystems that will be considered are mobility, navigation and life 
support. Communications are discussed elsewhere. In addition to mechanical 
or electrical failures of major subsystems, vehicle impairment due to acci- 
dents will be considered, e.g., collisions or immobilization due to some 
physical lunar surface •'trap." 

These hazards will be discussed for two major classes of lunar vehicles: 

1. Small, non-cabin, rovers with short range capability where life support 
is provided by portable life support backpacks. 

2. Large, cabin type rovers with long range capability and life support pro- 
visions which permit a shirtsleeve environment within the cabin. 

ASSUMPTIONS 

1. Small, non-cabin rovers will operate within walk-back range of a shelter. 

2. Large cabin type rovers will operate beyond walk-back range of the lunar 
base of operations. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. A lunar rover vehicle is immobilized due to a mobility subsystem failure 
or physical entrapment, stranding the crew beyond walk-back distance. 
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2. A failure associated with a lunar roving vehicle navigation subsystem 
isolates the crew. 

3. A system failure on a lunar roving vehicle deprives the crew of life 
support . 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1. Crew Stranded Beyond ^felk-back Distance 

1. Vehicle mobility failures affect astronaut safety differently as a func- 
tion of distance from a safe shelter. If small, non-cabin vehicles are 
incapacitated by a mobility failure, the astronaut(s) should be able to 
walk back to the shelter, based on the assumption that lunar sorties for 
these small vehicles are limited in range accordingly. Immobilization of 
large, cabin type vehicles presents the danger of stranding two or more 
astronauts beyond walking distance of a safe shelter. Furthermore, the 
possibility should be considered that the vehicle immobilized due to an 
accident may injure the astronauts, as well as the vehicle. 

Corrective Measures for Hazard 1 


Preventive measures: 

1. Vehicle Design - The large cabin rovers should be designed to contain both 
a primary driving station in the forward cabin area and an emergency re- 
dundant driving station in the aft airlock area. In addition, the pri- 
mary driving station should be designed for a two man "pilot/copilot" 
operation with one man able to conduct all essential functions in an 
emergency mode operation. Similarly, two man small non-cabin rovers 
should be operable by one man, but permit vehicle control takeover by 
either of the two crew members. 

Other safety design features include: 
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a. Incorporation of a roll bar in cabinless rovers to prevent injury to 
the astronaut in the event of vehicle overturn. 

b. Incorporation of terrain slope warning indicators at the driver's 
station to inform the astronaut that the slope being attempted is 
approaching the limits of the vehicle's capabilities. 

c. Seat and shoulder restraints for adequately securing the astronauts 
to their stations over "rough" terrain. 

2. Lunar surface hazard detection - The possibility exists that a rover 
could become immobilized by dropping into a crater or through a weak 
crustal surface. In the former case, preventing is largely accomplished 
by providing adequate forward unobstructed visibility and illumination 
aids, as required. The latter case may require hidden cavity sensors 
installed on booms as illustrated in Fig. 1. 


Cabin Type Rover 



Fig. 1 Hidden Cavity Sensor Concept 
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3. Planning traverses to reduce hazards - Traverse planning that makes 
maximum use of the roving vehicle’s capability to accomplish the scien- 
tific goals of the mission must also consider ways to reduce the hazards 
of exploration. Traverse paths can be designed to minimize distance 
from a safe haven. For example, a circular traverse, starting from a 
base located on the periphery of the circle, separates the vehicle from 
the base for a much greater extent of the traverse than one in which the 
base is located within the center of a planned circular traverse. 

4. Multiple vehicle expeditions - Another approach which reduces vehicle 
distance from a safe haven is to employ two vehicles making simultaneous 
traverses which complement each other. Although each vehicle would ex- 
plore different territorities, the distance from one vehicle to the other 
would be less than that of either vehicle to the lunar base from which 
the expedition originated. In this manner each vehicle would serve as 

a redundant support and rescue vehicle for the other in the event of an 
emergency. 

5. Supply caches - Another means for reducing the risks of being immobilized 

and isolated beyond a safe walk-back distance is to establish a series of 
depots containing a variety of life support/mission extension equipment. 
These depots could be strategically located at various points along the 
lunar traverse so that at no point would the astronauts be beyond walking 
distance from one depot to the other. Typical items that might be stored 
in such depots would include: Food, water, spare backpacks, fuel cells, 

batteries, medical supplies, radio and communication equipment, naviga- 
tional aids, and critical vehicle spares. 

Remedial measures : 

1. Each crew on traverse should carry redundant communication equipment, 
radio beacons, and visual signal devices to aid in rescue. 
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Escape/Rescue Requirement for Hazard 1 

If a lunar rover crew is stranded beyond walkback distance, rescue will be 
required. 

Effects of Hazard 2 . Isolated Crew 

Navigation system failures could lead to deviations from predetermined 
traverse plans with a resultant lengthening of the mission beyond available 
supplies of expendables, i.e., fuel and life support provisions. Lack of 
"true" information regarding the position, heading and distance from a lunar 
base of operations will also hamper rescue operations. 

Corrective Measures for Hazard 2 


Preventive measures: 

The navigation back-up should be independent of the ability to communicate. 
In addition, crewmen out on a lunar traverse should be provided with visual 
and auditory signalling aids to help rescue parties locate their position. 
These aids should consist of such items as rocket rescue beacons, deployable 
emergency antennas, reflecting sphere (visual and R F) and position indi- 
cator flags. Similarly, the base should radiate visual and auditory signals 
to facilitate a correct and expeditious emergency return to base. Depending 
on the point at which a navigation system failure occurs, and the available 
fuel reserves, the most advantageous course of action may simply be for the 
vehicle to retrace its path back to the lunar base. There should be no 
problem in visually following tracks made on the lunar surface since lunar 
surface characteristics (tracks) are very stable. 
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Remedial Measures: 

Each crew on traverse should carry redundant communication equipment, radio 
beacons, and visual signal devices to aid in rescue. 

Escape/Rescue Requirements for Hazard 2 

A rescue mission will be required to retrieve those astronauts who have been 
stranded due to navigation errors. 

Effects of Hazard 3 . Loss of Life Support 

Failures associated with the large rover cabin life support system will cause 
an abort of a lunar traverse mission and may jeopardize the lives of crewmen 
should backup systems be depleted before rescue or a return to base can be 
effected. Failures associated with portable life support systems utilized 
with small oabinless rovers are discussed in Hazard Study 23* 

Corrective Measures for Hazard 3 


Preventive measures: 

Life support system failures may arise which lead to the contamination of the 
cabin atmosphere, or loss of pressure or discontinuity in the supply of 
breathing gases. In each of these cases, the astronaut should don his space 
suit and rely on a suit loop supply for the abort mode return back to base. 

A second level of redundancy would consist of utilization of available por- 
table life support systems. An airlock, or dual safe compartment, is impor- 
tant in allowing the astronauts time to don their space suits. Additionally, 
if the airlock contains an emergency driving station, the astronauts can 
seal off a main compartment which is contaminated or ruptured and proceed 
back to the base by operating the large rover from the airlock emergency 
station. 


2-144 


LMSC-A984262C 


Remedial measures: 

1. Timely external assistance to provide life support. 

Escape/Rescue Requirements for Hazard 3 

A subsystem failure which brings life support capability to less than that 
required to reach a safe haven unassisted will have caused a requirement for 
rescue. 

DATA SOURCE REFERENCES 

1. SS-TR-060-3 , Synopsis of Safety Configurations for LRV's General Electric, 
Daytona Beach, June *70 - see Appendix 

2. D209-10Q15-1, LRV Failure Mode Effect & Hazard analysis. Boeing, 
Huntsville - June '70 

3. NASA-MSC - Surface Transportation PDD - 2 April 1970 

4. D2-113471-1, Specified LSSM Design Study, Boeing, Seattle, Nov. '66 

5. LMSC-A847943, MIMOSA Data Sheet No. 2422, Lockheed, Sunnyvale, April '67 

6. B6912066, Comparative Analysis of Life Support Systems for Emergency 
Return During Lunar EVA - Case 320, Bellcomm. Inc., Washington, Dec '69 
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HAZARD STUDY 21 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 

1. The use of two independent vehicles, each capable of assisting the other 
should an emergency occur, is recommended for long traverses with cabin- 
type rovers. Each rover must be capable of returning all crewmen to a safe 
haven. 

2. Non-cabin lunar surface rovers shall not operate beyond walk-back distance 
to a safe haven, unless such rovers are operated in pairs with each capable 
of supporting the other and returning all crewmen to a safe haven. 

3. All lunar surface rovers shall be capable of operation, driving, life sup- 
port, communication, etc. , with crewmen wearing pressurized suits. 

k. Each roving vehicle shall be completely operable and drivable by a single 
crewman. 

5. It is recommended that an emergency driving station be provided in the air- 
lock of cabin- type rovers. 

6. Methods and devices for detecting hidden cavities in the lunar surface ahead 
of a moving lunar rover should be developed. 

J. A series of depots or caches where critical supplies are stored along a 
planned lunar traverse route shall be considered in mission planning. 

8. Navigation aids to lunar surface crews shall be capable of continuing oper- 
ation even in the event of complete communications loss. 

9. Lunar surface roving vehicle design features should include lap belts and 
shoulder restraints, roll bars or similar protection from injury in the 
event of vehicle overturn, and surface slope warning indicators. 

10. A rescue plan shall be available in detail prior to each operational sur- 
face traverse mission. 

11. Doors, hatches, and airlocks on cabin- type roving vehicles shall be capable 
of accommodating a stretcher case plus a fully suited crewman. 

12. Lunar surface rovers shall carry redundant communications equipment radio 
beacons, and visual and auditory signalling devices to aid in rescue. 

13« Roving traverses should be planned to minimize distance from a safe haven 
while making maximum use of the vehicle's capability to accomplish scienti- 
fic exploration. 
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HAZARD STUDY 22 

PERSONNEL ACCIDENT OR IMPAIRMENT DURING SURFACE EVA 
INTRODUCTION 

The performance of tasks on the lunar surface associated with a transient or 
permanent lunar base will involve EVA operations and there will be astronaut 
interfaces with a wide spectrum of equipment and vehicles. These include: 

a. Scientific equipment emplacement and operation, frequently at 
distances exceeding two miles from the base. 

b. Lunar base and lunar vehicle maintenance, servicing, and repair. 

c. Deep drilling for subsurface cores in connection with seleneological 
studies. 

d. Operating open rovers and lunar flyers. 

e. Loading modules and/or equipment onto or off of vehicles. 

Potential hazards associated with the extravehicular mobility unit (EMU) are 
discussed in Hazard Study 23. Hazards due to the presence of lunar dust are 
discussed in Hazard Study 32 while the problems of lunar surface visibility 
and communications are discussed in Hazard Studies 2 6 through 30. 

ASSUMPTIONS 

1. The buddy system in EVA is not considered to be limited to astronauts 
in pairs. 

2. A malfunction in one astronaut's primary communication system (with the 
base) during EVA will not be cause for returning to base so long as he 
can communicate with his 'buddy' astronaut. Failure in both of their 
primary communications systems will be sufficient cause for mandatory 
return to base. 
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3. For activity more than one mile from the base EVA astronauts will norm- 
ally use a vehicle to take them to the site of the activity. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Mai function of life support system. 

2. Sudden illness leading to nausea and/or vomiting (this hazard is dealt 
with in Hazard Study 35- 

3. Entanglement with equipment (this hazard is dealt with in part in Hazard 
Study 20 )• 

4. Injury resulting in bone fracture or flesh wound. 

5. Rover or flyer accident leading to Hazard 4 plus unconsciousness. 

6. Contamination by fluid that is corrosive to space suit or suit parts. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 . Life Support System Malfunction 

The effects of a life support system (LSS) malfunction could include loss of 
thermal control, denial of oxygen or metabolic water, failure to remove 
contaminants, or a combination of any of these events. They are all serious, 
although the loss of oxygen must be considered critical. The loss of any 
of the functions for any length of time would result in illness, at least, 
while the denial of oxygen would result in the loss of the astronaut. 

Corrective Measures for Hazard 1 


Preventive measures: 

1. A:i emergency supply of oxygen should be available for each astronaut 
to permit him to get to a safe haven in the event of malfunction of his 
main supply. The option of manually activated supply for the emergency 
oxygen should be given the astronaut. 
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2. An emergency power supply should be available to run essential functions 
for life support long enough for the astronaut to get to a safe haven 
in the event of primary power supply failure. 

3. An emergency contaminant removal supply should be available under the 
conditions as for item 1 above. 

Remedial measures: 

1. The buddy system should always be used so that short term supplies are 
available; that is, the astronaut whose system has malfunctioned should 
be able to plug into his fellow astronaut's LSS. 

2. Any failure in the LSS should require an immediate, mandatory return to 
a safe haven. 

Escape/Rescue Requirements for Hazard 1 

1. The buddy system provides an escape method from the LSS malfunction 
although only for a limited time. 

2. If anything but the oxygen portion of the LSS malfunctions there exists 
some limited time for rescue. 

Hazard 2 is discussed in detail in Hazard Study 35 and not repeated here. 

Effects of Hazard 3 . Entanglement with Equipment (See Photograph on following 

page) 

1. Setting up structures such as large antennas or working with deep drill- 
ing equipment (e.g., depths of 200-300 meters) or erecting temporary 
shelters during an extended traverse, or laying out many pieces of equip- 
ment all connected to a single power source, thus yielding a wiring net- 
work on or near the surface, all lead to the problem of keeping equip- 
ment worn or the astronaut himself from becoming entangled. If the 
astronaut is working alone, entanglement could lead to injury or worse 
if the astronaut is isolated and trying to free himself. Depletion of 
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consumables is another danger faced if an astronaut is entangled and isolated} 
this could cause illness, or injury or loss of the crew member. 

Corrective Measures for Hazard 3 

Preventive measures: 

1. Erection of all structures on the lunar surface should be made auto- 
matic insofar as is reasonable. 

2. Wiring should be laid out so as not to form a 'net* . Scientific instrument- 
ation should be strung out and wiring buried where feasible. 

Remedial measures: 

1. By virtue of the buddy system one astronaut can disentangle another. 

2. As a measure to be used when a danger is imposed by not disentangling 
immediately, an EVA astronaut should have a pair of heavy duty wire 
cutters with which to free himself. 

Escape/Rescue Requirements for Hazard 3 

If an astronaut becomes entangled and is not working under the buddy system 
concept, he will have to be rescued. 

Effects of Hazard 4 . Injury Resulting in Fracture or Flesh Wound 

Involvement with the movement, emplacement, and/or erection of large and 
massive structures or instruments could lead to tip-over or collapse with 
resultant injuries to crew members involved in setting up these instruments/ 
structures. Fractures or flesh wounds are likely in such events. Although 
suit rupture in such accidents is also possible, it should be recognized 
that fractures and bruises could occur without suit damage. 
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Corrective Measures for Hazard A 

Preventive measures: 

1. All of the preventive measures recommended for Hazard 3 are applicable. 

2. The construction, erection, emplacement, etc., of all proposed lunar 
gtructures/instrumentation should be practiced on Earth without omitting 
any steps (i . e . , a complete training program) in order to uncover any 
difficulties that could arise on the moon and thus correct them before 
the lunar mission is initiated. 

Remedial measures: 

1. A portable lunar shelter should be available in the event the subject 
emplacements are distant from the base so that a fellow astronaut can 
supply first aid in the event of accident. A cabin rover should be very 
suitable in lieu of a portable lunar shelter. Splints and other first 
aid items should be included as standard equipment in rovers and other 
lunar shelters. 

Escape/Rescue Requirements for Hazard A 

1. If an astronaut is seriously injured he will have to be brought back 
to the LSB or to the lunar space station or to Earth for treatment of 
his injuries. 

Effects of Hazard 5. Accident Leading to Unconsciousness 

1. The effects of adding unconsciousness to injury (as in Hazard 4) makes 
it necessary to move the injured astronaut without his cooperation. 

This procedure will place a burden on the other crew members engaged 
in activity at the accident site. Should the astronaut happen to be 
alone when injured and unconsciousness ensues, then he could be lost. 
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Corrective Measures for Hazard 5 

No preventive measures sire identified. 

Remedial measures: 

1. A prime measure here is mandatory use of the buddy system so that an un- 
conscious crew member can receive immediate attention and so that the 
buddy can contact the base to prepare for receipt of the injured astronaut 
and to possibly render aid. 

2. A means for a single crew member to move an unconscious buddy is required; 
for example, a stretcher that could be dragged or wheeled to the cabin 
rover and hand-winched up a portable ramp into the rover. Such a measure 
prevents the on-site loss of the astronaut. 

Escape/Rescue Requirements for Hazard 5 

1. Should the on-site crew not be able to render first aid and/or move the 
unconscious crew member to safety a rescue will be nesessary . 

Effects of Hazard 6 . Contamination by Corrosive Fluids or by Lunar Dust 

1. Various corrosive fluids will be used in the lunar complex and particu- 
larly at the LSB. Some of these fluids are hypergolic and may react 
with space sud t material or materials identified with nearby equipment. 
These oxidation reactions are violent and therefore pose a danger to 
any EVA astronauts engaged in handling these fluids. Skin, flesh, and 
eye injuries are likely if contact is made with corrosive fluids. Should 
the spacesuit be attacked by the fluids then the astronaut’s life sup- 
port system integrity will also be endangered with evident and serious 
consequences. 
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When lunar dust is kicked up by walking EVA astronauts the dust exhibits 
a very strong tendency to adhere to the boots and spacesuits of the crew- 
men. Such dust gets into Joints of the spacesuit and abrades their 
seals thus leading to increased leakage of the suit-contained atmosphere. 

If the dust is tracked into a lunar shelter or lunar vehicles it per- 
meates the atmosphere and yields a considerable irritant to the respiratory 
systems of the crewmen. In addition, it settles on display-control panels 
and other equipment, posing an abrasive hazard to that equipment. 

Corrective Measures for Hazard 6 

Preventive measures: 

1. Detailed consideration should be given to the substitution of passive fluids 
in place of the corrosive ones, assuming that such substitution does not 
compromise, to any serious degree, the functions of those fluids. 

2. Hazardous fluids should be handled by EVA astronauts wearing protective 
overgarments to ensure that neither fluid nor fumes contact his spacesuit, 
boots, etc. The overgarment would be discarded before entering a shelter. 
In order to protect against lunar dust 'invasions' similar overgarment 
use should be initiated. 

3* There should be a very strongly enforced rule indicating storage of all 
corrosive fluids at a (determined) safe distance from the surface base 
or shelter. 

4- No EVA astronaut should be near any surface or space vehicle - unless 
he is aboard - during the initiation of motive power in order to avoid 
contamination by corrosive fumes. 

5. Astronauts using the lunar flyer will need some protective garment to 
keep the exhaust fumes from contaminating their spacesuits, boots, and 
equipment. 

Remedial measures: 

1. An EVA astronaut injured by corrosive fumes will need immediate medical 
attention, therefore, appropriate first aid kits should be available and 
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a tempo rary lunar shelter in which to apply such first aid. The cabin 
rover would serve as an excellent lunar shelter. 

Escape/Rescue Requirements for Hazard 6 

1. An EVA astronaut seriously injured by corrosive fumes that cannot be 
treated out on some traverse will have to be rescued for treatment at 
the base or shelter. If surface facilities are insufficient, return to 
lunar orbit or Earth for treatment may be required. 

ADDITIONAL INFORMATION 

It is recommended that studies be conducted to consider alternatives to 
use of corrosive fluids in the lunar complex. The extent of functional 
promise and delta costs should be considered in such studies as well as 
safety advantages to be gained in the use of such alternate fluids. 

RECOMMENDED ADDITIONAL STUDY 

In the event of nausea accompanied by vomiting it would be critically impor- 
tant to be able to reach past an astronaut's face plate to remove solids 
from the area in and around his mouth and nostrils. The kind of device sug- 
gested constitutes a flexible, globular (when inflated) glove box that could 
be fitted over the affected astronaut's head and made pressure tight at his 
neckband. It is suggested that further studies be conducted in this area to 
ascertain the value and form of such a device. 

DATA SOURCE REFERENCES 

1. Mimosa Data Sheet, 3111-04, LMSC/A847943, April 1967. 

2. Emplaced Scientific Station, Westinghouse, Report No. SD-240, April 1966. 

3. Lunar Escape Systems, North American Rockwell, Report No. SD 69-593, 

June 1970 and NASA CR-1619, June 1970. 
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4. Apollo 12 Mission Report, MSC-01855. 

5. One Man Lunar Flying Vehicle, Bell Aerosystems Report No. 7335-950012, 
July 1969. 
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HAZARD STUDY 22 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. Emergency oxygen supplies should be readily available to an EVA astronaut 
in the event of failure of his primary system. 

2. The buddy system, or presence of a safety man, should be mandatory for EVA 
astronauts under normal conditions unless they are within a few tens of 
meters of the LSB or of the cabin rover or of the landed tug, and standby 
help is immediately available. 

3. All EVA spacesuits should be designed to permit a fellow astronaut to plug 
in on another's life support system in the event of failure of his own I£SS. 

4. Failure or degradation of his life support backpack should make return to 
a safe haven mandatory and immediate for an EVA astronaut. 

5- Erection of large structures/instruments should be automatic insofar as is 
reasonable without seriously compromising function or costs for the lunar 
complex. 

6. For long distances or long-duration traverses, a temporary lunar shelter 
should be available for EVA astronauts in which to take refuge in the event 
of accident, injury, or other undesirable incident. Among supplies in such 
shelters should be - as a minimum - splints and first aid kits. 

7. A means shall be provided for a single astronaut to move an unconscious 
EVA astronaut from an accident location to a nearby safe haven. 

8. All corrosive fluids should be handled by EVA astronauts wearing a pro- 
tective overgarment and protective boots or boot covers. 

9. No EVA astronaut should be outside and in the immediate vicinity of any 
vehicle on the lunar surface during the initiation of motive power. 

10. EVA astronauts using the lunar flyer should wear a protective garment 
during the interval that the flyer's engines are turned on in order to 
prevent contamination from engine exhaust. 
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11. Repair kits, analogous to the tire repair kit, should he available for 
all EVA astronauts (in general, for all suited astronauts) in order to 
be able to repair minor and medium suit leaks. Means should be provided 

f 

for determination and location of leaks. 

12. Decals that can easily be read by EVA crewmen should be provided to iden- 
tify equipment function. Identification should also be provided for each 
EVA crewman so that he can be 'recognized* in video transmission. 
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HAZARD STUDY 23 

HAZARDOUS OPERATIONS WITH EXTRAVEHICULAR MOBILITY UNITS 
INTRODUCTION 

This section considers hazards to the astronaut associated with failures of 
the EMU on the lunar surface. These hazards can be generated from three 
sources: failure of space suit/back-pack components, deleterious lunar en- 

vironmental effects on the EMU, or operational astronaut accidents which 
inflict damage on the EMU. 

ASSUMPTIONS 

For the purposes of this analysis it is assumed that lunar surface extra- 
vehicular operations will be conducted in three basic contexts: 

a. In the immediate vicinity (walking distance) of a lunar base. 

b. Small excursions from a lunar base by means of a small cabinless 
lunar rover. 

c. In association with a large lunar roving vehicle with mobility and 
habitability provisions. 

The time frame for this analysis is the 1980—90 period. Certain advances in 
the suit/back-pack state-of-the-art, explained below, are postulated. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Suit rupture. Suit integrity may be compromised by the following factors: 

a. Operational accidents - falling off boarding/debarking ladder, vehicle 
overturning, tripping over natural object or emplaced scientific 
equipment, rupture of glove or suit due to harsh contact with system 


hardware . 
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b. Suit deficiencies: e.g., oxygen leaks through defective seals, 
breakage of cable connecting EVA glove to wrist (Apollo 14). 

c. Inadvertent disconnection of back-pack hoses. 

d. Environmental hazards such as meteorite penetration. 

2 . Back-pack failure 

a. Communications or telemetry 

b. Og supply/pressurization 

c. Thermal control including either the oxygen circulation system in 
the PGA or water circulation system in the LCG. 

d. Carbon dioxide removal 

e. Odor and contaminant removal 

f. Humidity control 

g. Power failure. 

3. Interruption of Life Support Provisions during Back-Pack Switching 
Back-pack switching in the lunar vacuum environment involves the poten- 
tial threat of interrupted life support provisions if the transition is 
not effected properly. 

4. The loss of the face mask’s heat/glare reflective coating which is essen- 
tial for eye protection. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1. Suit Rupture 

Small suit ruptures may cause mission interruption at most and constitute a 
minor hazard only - as discussed below. A medium leak, as defined below, 
does demand immediate attention. A large rupture, however, would be very 
serious. Depending on the particular rupture and concurrent leak rate, loss 
of consciousness can occur in 20 seconds. The death of an astronaut could 
occur in 3 to 5 minutes, depending on the size of suit rupture and the 
ability of the back-pack to sustain oxygen supply and pressure. 
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Corrective Measures for Hazard 1 


Preventive measures: 


Prevention of potential catastrophic suit damage requires a consideration of 
two approaches: 

1. Improvements in space suit design which can be expected to take a number 
of forms: 


a. The greatest current need is for increased capability in mobility in 
a suited astronaut. Additionally, astronauts must have improved 
visibility and decreased suit encumbrances. At present, the protec- 
tive envelope provided by the suit negates most cutaneous sensitivity 
cues. Consequently, the astronaut is not aware of objects brushed 
against until he is snagged or comes into hard contact with such 
object. Means for providing contact cues to the suited astronaut 
should be investigated. 

b. Other suit improvements to be considered for the future include self- 
sealing concepts for coping with small suit tears or punctures, com- 
partmentalizing of suit segments so that a tear in one segment seals 
off a given compartment without depressurizing the entire suit, and 
protective cocoons for immediately enveloping an astronaut subsequent 
to a sudden pressure drop. The use of an emergency pressure garment 
donned over the liquid cooled garment (LCG) should also be considered. 

c. Development and application of new materials will make the suits in- 
creasingly more resistant to scuffs, abrasions, snags and tears. An 
amalgamation of "hard" and "soft" suit concepts may also occur to 
provide increased micrometeorite protection as well as general re- 
sistance to "wear and tear." 
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d. Ultimately it would be desirable to design an integrated back-pack 
and space suit. The back-pack to be attached to the suit so that 
upon completion of donning the integrated pair are immediately in an 
operational mode. Since current hoses hang loose and are in danger 
or being snagged or inadvertently disconnected, a future suit would 
have them integral and take up less volume than the current clumsy 
hoses do. A rectangular cross section hose, flexible but not collap- 
sible, would be a step in the correct direction. 

It would be desirable to have such a suit fail-operational, fail 
operational, fail-safe and require a simple checkout procedure. Care 
should be taken that variations in turn-on or shut-off sequences for 
operation of such an integrated suit-backpack will not pose any 
dangers to the wearer. The gold, heat-reflective layer in the face 
mask- might be emplaced between layers of plastic to ensure its pro- 
tection against abrasion, peeling or scratching. 

It would be advantageous to have a readout system for the oxygen 
flow rate so that a suit wearer would be informed on either excessive 
or insufficient oxygen usage as well as time-to-go in the EVA mode 
as a function of such flow rate. 

e. It is desirable for EVA astronauts to always use the buddy-system 
(ability for mutual plug-in capability - suit to suit - and use of 
all backpack consumables) so that feasible repairs can be made on 
the spot for accidental suit penetrations. A kit analogous to a tire 
repair kit would be desirable for such a function. 

2. The second approach to suit damage prevention involves detailed safety 
attention to the design of lunar hardware systems and mission activities. 

The following recommendations are made so as to improve astronaut safety: 

a. Development of shelter/vehicle ingress/egress provisions that avoid 
failing or snagging of suit or back-pack connections. 
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b. Systematic review of all hardware surfaces that the astronaut may 
come in contact with to eliminate abrasive edges, unstable standing 
platforms (planned or unplanned) and protrusions. 

c. Design of vehicle deployment systems that preclude manual involvement 
of the astronaut with the possible consequence of objects falling on 
the astronaut. 

d. Provisions to adequately guard against lunar vehicle overturn; e.g., 
indications of excessive slope beyond the capability of the vehicle, 
roll bars and seat restraints. 

e. Development of scientific equipment hardware and emplacement proced- 
ures that precludes astronaut tripping over wires or components. 

f. Design of appropriate illumination aids for lunar night operation. 

Remedial measures: 

1. Actual use of the available suit repair kit noted in preventive measures 
under 1(e) is a remedial step. The buddy-system increases the feasibility 
of such kit use. Hazard Study 15 should be referred to for measures 
taken concerning vehicle overturning, equipment emplacement. Hazard 
Studies .H and 22 deal with the meteoroid penetration phenomena for EVA 
astronauts. 

Escape/Rescue Requirements for Hazard 1 

Rescue options are a function of oxygen loss and a function of the distance 
of the disabled astronaut from a habitable shelter or source of replenishment 
supplies. The following provides the rescue measures or options appropriate 
for various conditions of suit leak rates and operational factors : 

1. Large oxygen flow rate from suit, e.g., hose disconnected or torn. 

This type of suit failure is catastrophic with state— of— the— art suits 
even if the astronaut is close to a lunar shelter or spare PLSS on a 
lunar rover. To cope with this class of suit failure new design features 
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are required such as automatic sealing of the hose port if the hose is 
disconnected as well as a method of eliminating hoses hanging loosely 
on the suit. The latter is discussed above in corrective measures 1(d). 

2. Medium Suit Leak 

This situation is defined as one in which the astronaut is losing oxygen 
supplies at such a rate that he has a relatively short time (say, about 
l/2 hour to return to a habitable shelter.) 

If a medium suit leak occurs while the astronaut is on a non-cabin rover 
sortie he has the following options : 

a. Ride back to shelter as quickly as possible. 

b. If ride-back distance is too far, plug into spare back-pack or 
vehicle-mounted life support system. 

c. Call for rescue by means of a lunar flying vehicle. 

d. If a second lunar rover is available, have it meet returning rover 
half way with spare back-pack. 

e. The remedial measures noted above suggesting a tire repair type kit 
is also recommended for the medium leak situation. 

3. Small leakage 

A small leak would normally allow the astronaut conducting EVA operations 
in the vicinity of a shelter or cabin rover to walk back to the shelter 
or rover. For non-cabin rover operations, the astronaut could either 
ride back unassisted depending on the time into the mission and the dis- 
tance from the shelter or extend his life support supplies by connecting 
to a vehicle mounted life support reserve or a spare back-pack. 

Recommendations : 

1. Because the face mask is plastic and because techniques have been de- 
veloped to ascertain strains brought upon plastic forms when stresses 
are put upon them it may be possible to adapt this technique to detecting 
imminent mask failure. This method depends upon the fact that the appli- 
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cation of force to the plastic yields a series of diffraction patterns 
that can be photographed. No doubt these patterns can be detected by 
other sensor techniques. It is recommended that studies be conducted 
in this area to determine the adaptability of the methodology for this 
use. It may be possible to have the astronaut continually wear a flex- 
ible, plastic, folded emergency cover which can be pulled over his head 
and sealed at the neckband as an interim measure. This technique should 
be studied and its value ascertained. 

2. A repair kit analogous to the tire repair kit should be developed, after 
appropriate study, for on-the-spot remedy of small and medium suit leaks. 

3. A 'clock 1 should be developed to inform the wearer of a PLSS how much 
EVA time remains for him as a function of his remaining oxygen supply 
and as a function of its instantaneous use rate. 

Effects of Hazard 2 . Back-pack Failure 

The effects of the loss of use of the back-pack are catastrophic and lead to 
the loss of the astronaut unless sufficient countermeasures are instantly 
available. The effects of communications/telemetry and power failures are 
discussed in Hazard Studies 7 and 20 and will not be repeated here. 

Primary system failure leads to switching to the emergency back-up oxygen 
purge system. Power failure as well as all other failures listed in the 
major hazard list will have the effect of (temporarily, at least) terminating 
the operation and require an immediate and mandatory return to a safe haven. 

Corrective Measures for Hazard 2 


Preventive measures: 

1. A thorough and complete checkout before each EVA sortie should be manda- 
tory for the back-pack, the suit, and all related equipment. 
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2. It is highly recommended that an integrated suit and back-pack be de- 
veloped (as discussed in corrective measures for Hazard 1 ) that can be 
operated without concern as to the order of activation or inactivation 
of the hardware. 

In designing such a suit-backpack all possible anticipated modes of 
operation must be considered so as to negate the need for any "procedural 
workaround" sequences resulting from deficiencies in the original equip- 
ment design. 

3. The following list of items are preventive in the sense that the avail- 
ability of the hardware of procedures listed will prevent loss of the 
astronaut if his primary system fails. In the sense that the use of the 
hardware and/or procedures becomes necessary the list can be considered 
remedial. Back-pack Failure - Reduction of the hazards associated with 
back-pack failure beyond the backup oxygen purge system (OPS) capability 
should include: 

a. A backup power system with a minimum capability of 30 minutes. 

b. A backup communications system. 

c. Mandatory use of the buddy system for all EVA except within 100 
meters of the LSB. 

Incorporation of "buddy system" features into back-pack design to allow 
an astronaut in distress to share a good back-pack with another astro- 
naut. These features should be designed to allow for the overload im- 
posed by two astronauts or insure that the degraded performance caused 
by two astronauts sharing the back-pack will not impair rescue success. 

Desirability of making an emergency pack available during EVA excursions 
or umbilical backup supply from the base or roving vehicle as long as 
astronaut operations are in their proximity. 
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Remedial Measures: 

1. Size all emergency and backup systems to all primary systems so that 
both survivability and rescue requirements are consistent with the rescue 
equipment available for the mission. 

2. Emergency systems, like the primary system, should be redundant in de- 
sign to provide fail-operational, fail-operational, fail-safe conditions 
to the overall system. 

3. Use of a fellow astronaut's back-pack; that is, use of the buddy-system. 

4. Availability of an extra back-pack at the operations site. 

Escape/Rescue Requirements for Hazard 2 

Failure of a primary backpack generally entails the same rescue/escape op- 
tions as described for suit penetrations or leakages. 

In these cases, the astronaut within walking distance of a shelter would 
return immediately to the shelter with the assistance of a companion astro- 
naut. For the case of a non-cabin rover sortie, the lunar rover would 
return directly to base with the "buddy" astronaut driving the vehicle. 

Recommendations : 

It is recommended that studies be conducted to ascertain minimum power and 
communications requirements for use as backups in the event of failure of 
these functions in a back-pack. 

Effects of Hazard 3 . Back-pack Switching Accident 

Should the act of back-pack switching not occur smoothly the astronaut ' s 
life support system would be lost to him and the result would be catastrophic, 
leading in the worst case to loss of the crew member. The effect here is 
the implied threat of interrupted life support functions and its conse- 
quences . 
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Corrective Measures for Hazard 3 


Preventive measures : 

1. Backpacks should be designed for "buddy system" operation. In this 
manner an astronaut with a defective backpack could connect himself to 
the backpack of his companion or his buddy could perform this function. 
This multiple use of a single backpack would obviously deplete remaining 
expendables at a much faster rate and emergency walkback capability would 
be accordingly reduced. In the event of vomiting this would not be done 
- see remedy measures below. 

The buddy system is defined as that operational mode of activity wherein 
at least two members of a space mission crew perform tasks with both (all) 
members conducting tasks while near each other at the same site. The 
buddy system necessarily includes the capability for each crew member to 
use the subsystems of his fellow crew member by the existence in their 
equipment of hardware which permits such mutual (multiple) use. 

Thus, if each of two crew members carries N subsystems (life support, 
communications, power, etc.) there are then 2N subsystems for their 
mutual support. The psychological comfort of having a fellow crew member 
immediately available in the event of accident, equipment malfunction, 
illness, or any other irregularity serves to greatly increase the confi- 
dence of the buddy system crew. 

By no stretch of the imagination can the buddy system be considered to 
be in effect if one member of the team is outside a spacecraft or lunar 
base while his monitor(s) is inside the spacecraft or base; no matter 
whether the latter is suited-up or not. 

2. Small cabinless lunar rovers could provide extra or spare backpacks and 
back-pack switching aids. Backpack switching aids conceived of to date 
have been cumbersome to use and far from foolproof when operated by an 
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unassisted astronaut. Suit/backpack interfaces have not been designed 
to insure an efficient and safe mating that can be managed by a single 
astronaut on the lunar surface. Therefore, back-pack switching requires 
assistance from a second astronaut or improvements in the suit/back-pack 
mating design and/or the aids for accomplishing this operation. 

3. Small lunar rovers could be equipped with ECS provisions for either re- 
plenishing expended backpacks or for emergency plug-in for an emergency 
return to a lunar base. 

Remedial measures : 

Backpack switching in the lunar vacuum as a means for extending normal 
mission duration should be avoided until foolproof techniques are available 
and easily effected by the space suit encumbered astronaut. Emergency switch- 
ing of backpacks can be effected with the assistance of a companion astronaut. 
In addition, backpacks should have the capability of simultaneously sup- 
porting two astronauts for emergency assistance purposes. 

1. In the event of vomiting the concerned astronaut must be taken to a 
safe haven immediately before he chokes on his regurgitated food and 
before the debris clogs his suit functions. The length of time to choke 
on food particles trapped in the trachea is a function of the percentage 
of obscuration of the air passage. For total blockage the time is about 
2 minutes - about the time a good diver can hold his breath under water. 

Recommendations : 


It is recommended that a study be made to determine techniques of opening an 
astronaut's faceplate to help him clear his suit of regurgitated debris and 
to aid in clearing his mouth and throat of this debris. A totally enclos- 
ing, inflatable, zipper closed 'balloon' is a possible approach to this 
problem. 
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HAZARD STUDY 23 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

Back-pack switching in the lunar vacuum environment shall not be re- 
quired as a means for normal extension of mission duration. 

Back-pack switching aids shall be provided only for emergency-switching 
of backpacks. 

Back-pack design shall permit buddy system attachment and operation for 
all life support functions and power and communications. 

Emergency life support shall be provided in the form of spare back-backs, 
vehicle mounted systems or strategically located supply caches distributed 
along a mission route. Specific requirements shall be mission peculiar. 
The "buddy system" using astronauts at least in pairs for all EVA opera- 
tions, or the presence of a safety man, should be mandatorv. 

Space suit design efforts should continue to stress increased astronaut 
mobility performance capabilities, integrations of separate suit elements 
into one garment, increased resistance to tear and abrasion and emergency 
corrective measures to prevent catastrophic suit leaks. 

Lunar hardware systems must be designed to preclude accidental damage to 
suits and backpacks. Such measures include development of safe vehicle/ 
shelter ingress/egress provisions and aids, avoidance of abrasive hard- 
ware edges and protrusions which can snag suits or hoses. 

Scientific mission activities shall be organized to avoid tripping over 
emplaced scientific equipment and its connecting cables. 

Repair kits, analogous to the tire repair kit, should be available for 
all EVA astronauts (in general, for all suited astronauts) in order to 
be able to repair minor and medium suit leaks. 


All back-packs and interrelated equipment should be designed to fail- 
operational, fail-operational, fail-safe. 

All hose connections should have automatic, self-sealing ports for the 
eventuality of inadvertent hose-disconnection. 
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12. External protuberances such as hoses, electrical lines, etc., on all space 
suits should be eliminated by improved design. 

13. The gold plated, heat reflective layer on the spacesuit face masks should 
be sealed between two layers of plastic in order to protect that layer 
from scratching, abrasion, or peeling. 
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HAZARD STUDY 24 
LUNAR FLYING VEHICLE HAZARDS 


INTRODUCTION 

A lunar flyer may be used for the scientific investigation of areas of the 
Moon that would be impossible to reach with surface transportation. Such 
areas as crater walls and ridges, central crater peaks, the uppermost pro- 
montories and cliff faces may involve the use of the flyers. The flyers 
considered here are the non-cabin type, with life support and communication 
provided by personal life support systems (PLSSs) . They can carry at least 
two men. 

ASSUMPTIONS 

1. The lunar flyer preferred crew is two or more, but a flying investi- 
gation could be conducted by one man. 

2. The flyer will have a limited range capability which is considered to 
be about 13 km (8 nm) . 

3. Sites selected for lunar flyer investigations will in general have been 
photographed from orbit and perhaps from the lunar surface in order to 
obtain topographical knowledge for the scientific investigations and to 
permit planning for escape/rescue should that become necessary. 

THE MAJOR HAZARDS 

The major hazards identified ares 

1 . A l unar flying vehicle impacts the surface at excessive velocity 
following malfunction of a critical subsystem or through control 
input error. 

2. Loss of communications. 

3. A PLSS malf unction during the course of a lunar flying mission. 
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4. Poor visibility of the lunar surface during landing, considering 
lunar dust and sun-lighting effects. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1. Excessive Impact Velocity 

A high velocity impact will result in the loss of the lunar flyer crew. Other 
crew members of the lunar complex would investigate the accident 
but not in a rescue mode if the impact at high velocity was ' seen' on radar or 
by other means. 

Should the lunar flyer and crew experience a low velocity impact the expecta- 
tion is that the crew will suffer some injury and the flyer will be damaged 
so that it would at least be in need of repair before it could be used again. 

A major concern involves the sudden isolation of the crew in the event of an 
impact. If astronaut injuries are of a serious nature the isolation problem 
is compounded. Should the crew' s PLSSs be damaged the severity of the prob- 
lem increases further. 

Corrective Measures for Hazard 1 

Preventive Measures: 

1. Duplicate the propulsion and control systems, except for tankage and 
propellant, so that either system is capable of operating the flyer. 
Fail-operational, fail-operational, fail-safe philosophy should be 
observed. 

2. Limit the altitude and velocity of the lunar flyer so that the highest 
impact speed or fall from highest operating altitude will not likely 
result in serious injury to the crew. 
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3. Special protection for the PLSS should be designed for use with the 
lunar flyers to prevent loss of integrity in the event of low velo- 
city impact. In addition, an emergency oxygen supply, capable of 
withstanding the impact without impairing its function, should be 
available for each crew member. 

4. A crash-survivable communications beacon and voice transmitter should 
be aboard every flyer. 

5. To further limit isolation the use of a preferred mode of lunar flyer 
operation is suggested. This involves towing the flyer on a trailer 
attached to a rover (preferably cabin type) to near the site of 
interest. The lunar flyer is then used to get to the desired site. 

A total rover-flyer crew of three is suggested as a minimum for this 
operation. 

Remedial measures: 

1 . If injuries and PLSS damage are such that the crew members are ambula- 
tory and life support available, rescue assistance should be requested 
from the surface operations base. The flyer crew could then walk on a 
prescribed path to meet the rescuers. This situation implies that the 
lurain of the impact site can be negotiated by the crew on foot. 

2. Alternately the crew would have to make use of their first aid equipment 
and communications capability until outside aid was available. 

Escape/Rescue Requirements for Hazard 1 

1 . If the crew is ambulatory after their accident they would contact their 
operations center and proceed on foot on a prescribed path maintaining 
radio contact throughout while a rescue party got underway. 

2. If injuries are too severe to permit movement, the crew members would 
have to be rescued within the time limits bounded by PLSS supplies. 
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Effects of Hazard 2 . Communications Loss 

This hazard is discussed in Hazard Study ?9 and will not be repeated here. 

Effects of Hazard 3 . PLSS Malfunction During a Lunar Flyer Mission 

This hazard is dealt with i n detail in Hazard Study 23 and will not be re- 
peated here. 

DATA SOURCE REFERENCES 

1 . NASA-MSC Surface Transportation PDD , June 1 970 

2. One-Man LFV, SD69-41 9-1 , Final Report 

3. One-Man LFV, 7335-950012, Summary Report 

4. Lunar Escape Systems, SD69-598 , Tech Report, NAS Space Division, Oct 1969 

5. Lunar Escape Systems Summary, NAS CR-1619 

6. Manned Lunar Flying Machines, Meyer/Kitchens , paper to SAE, May 1968 

7. Lunar Flying Vehicles, 7266-950001, Bell Aerosys terns, January 1967 

8. Apollo12 Mission Report, MSC-01855, March 1970 
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HAZARD STUDY 2k 
SUMMARY OF SAFETY GUIDELINES 


1 . Lunar flying vehicles shall have fully redundant propulsion and control 
systems, except for propulsion tankage and propellant. Fail-operational, 
fail -operational, fail-safe philosophy shall be observed. 

2. Each lunar flyer vehicle shall carry a communications beacon and voice 
transmitter capable of withstanding any crash survivable by a crewman. 

3. Special protection from low velocity impacts should be provided for EVA 
backpacks used on lunar flyer missions, and an additional emergency 
oxygen supply capable of withstanding the impact without impairing its 
function should also be provided. 

4. Lunar flyers shall be prohibited from landing in any area which cannot 
accommodate a second flyer. 

5. All solo' lunar flyer missions shall have a crew of at least 2 men with 
the vehicle flyable by one man. 

6. All lunar flyers shall be capable of carrying at least one pilot, plus 
one passenger who may be incapacitated. 

7. Use of two flying vehicles on each flyer mission, each capable of re- 
turning the crewmen of both vehicles, is strongly recommended. 

8. Continuous communication with the base is required for the entire period 
of all lunar flyer missions. 

9. In planning flying missions into potentially dangerous locations a rescue 
plan shall always be determined beforehand. The range/time capability 
of the rescue mode shall determine the maximum allowable range/time-away- 
from-base of any lunar flyer mission. 

10. Mission planners must have a precise knowledge of the limitations in 
performance of the f Iyer/ crewman combination and detailed information 
on landing site topography prior to initiating a lunar flyer mission. 
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11. Lunar flyers shall be operated only when solar lighting conditions 
will be favorable for both the outbound and inbound legs of a 
mission, except in an emergency. 

12. Immediately after landing a lunar flyer at a remote site the crew 
shall determine the status of their vehicle and report findings to 
to the base. 
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HAZARD STUDY 25 

TOTAL DESTRUCTION OF A PRIME VEHICLE 


INTRODUCTION 

This study area considers the hazards generated as a consequence of the total 
loss of any one of the prime program equipment elements. These prime elements 
include transport vehicles, lunar lander tugs, orbiting lunar stations, lunar 
surface bases, roving vehicles, and flying vehicles. 

ASSUMPTIONS 

1. The total loss of a program element is assumed to occur suddenly and 
without prior warning. Causative factors are not considered a part of 
this study. 

2. Nominal mission activities are assumed to be in progress at the time of 
the loss event. 

THA MAJOR HAZARDS 

The hazard generators are considered to be: 

a. Loss of a chemical or nuclear prime transport vehicle (PTV) 

b. Loss of an orbiting lunar station (OLS) 

c. Loss of a lunar lander tug (LLT) 

d. Loss of a lunar surface base (LSB) 

e. Loss of a lunar roving vehicle (LRV) 

f. Loss of a lunar flying vehicle (LFV) 

The loss of one of these prime equipment elements is considered to generate 
the following hazards. 

1. Vehicle debris, and perhaps contaminating particles, are left in lunar 
orbit or on the lunar surface following destruction of a program element. 
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2. Crewmen are stranded and/or deprived of metabolic needs and a safe haven 
following destruction of a prime vehicle or base. 

3. Hazardous survivor search, extraction, and recovery is required following 
destruction of a program element. 

4. Rescue capability is lost following destruction of a program element. 
ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 . Vehicle Debris 

Vehicle debris or contaminating particles left in lunar orbit or on the lunar 
surface, following destruction of a program element, constitute a collision 
hazard and perhaps a nuclear radiation hazard. These hazards may be present 
for long periods unless action is taken to eliminate them. 

Corrective Measures for Hazard 1 

Preventive measures: 

None identified. 

Remedial measures: 

1 . Manned or unmanned space tugs might be used to capture and dispose of 
non-radioactive debris in orbit, through deorbiting to a safe area on 
the lunar surface, boost to escape velocity, or hold for return to 
Earth. 

2. Unmanned space tugs might be used to capture and dispose of radiation- 
contaminated debris in orbit through boost to escape velocity. 

3. Impact of radiation-contaminated materials on the lunar surface may 
require quarantine of a considerable surface area until the specific 
debris location can be identified and either cleaned up or enclosed. 

Escape/Rescue Requirements for Hazard 1 
None identified. 
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Effects of Hazard 2 . Stranded Crewmen 

Destruction of a prime vehicle may create hazards of isolation or deprivation 
of life support needs for crewmen dependent on that vehicle, but spared from 
the initial destructive event. These situations may include: 

a. Crewmen are in a tug in lunar orbit when their orbiting lunar 
station is destroyed. 

b. Crewmen are in an orbiting lunar station when their stand-by 
tug is destroyed. 

c. Crewmen are in a lunar surface base when their stand-by tug 
is destroyed. 

d. Crewmen are on surface EVA from a solo lunar lander tug when 
that tug is destroyed. 

e. Crewmen are on EVA from a roving or flying vehicle traverse 
when their rover or flyer is destroyed. 

f . Crewmen are on local EVA when their lunar surface base is 
destroyed. 

g. Crewmen are in an orbiting lunar station awaiting resupply and 
crew rotation when the incoming prime transport vehicle is 
destroyed. 

The effects of these situations may range widely, from imposing a need to wait 
in relative comfort for rescue or delivery of a replacement tug (situations b 
and c) to urgent need for additional life support and rescue (situations d and 
e). A very sizeable study would be required in order to consider the full 
matrix of situations , conditions, and hazard effects possible following loss 
of prime program elements. This cannot be accomplished here, and the follow- 
ing corrective measures are therefore of a very general nature. 

Corrective Measures for Hazard 2 
No preventive measures are identified. 
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Remedial measures: 

1. Provide a rescue capability and rescue plan which considers all 

credible combinations of loss of a prime element with mission phase, 
mission timing, and crew activity. 

Escape/Rescue Requirements for Hazard 2 
See remedial measures statement above. 

Hazards 3 and 4 are beyond the scope of this study, but will require careful 
attention in detailed future mission pl ann ing,, 

RECOMMENDATIONS FOR FURTHER STUDY 

Much of the analysis required to properly analyze and cope with the hazards 
identified here is beyond the scope of the present effort. It is nonethe- 
less evident that loss of a program element could have serious consequences 
that must be considered in planning for advanced lunar operations. The 
following studies are therefore suggested: 

1 . In the planning of future missions a study is required to determine 
the credibility of total loss, individually, of each prime item of 
lunar exploration equipment proposed. 

2. It is recommended that a position study be accomplished relative to 
the disposition of non-nuclear vehicle debris which may be generated 
in lunar orbit. 

3. It is recommended that a joint NASA/AEC position study be accomplished 
relative to the disposition of nuclear debris which may be generated 
through accident or failure in lunar orbit. 
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HAZARD STUDY 25 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 


1. Prior to the initiation of advanced lunar missions, methods and a plan 
shall be devised for disposing of nuclear and non-nuclear debris in 
l unar orbit. Use of a space tug in both manned and unmanned configu- 
rations shall be considered for use in debris removal. 

2. Prior to the initiation of advanced lunar missions a rescue plan which 
considers all credible combinations of loss of a prime element with 
mission phase, mission timing, and crew activity, shall be developed. 
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HAZARD STUDY 2 6 

THE HAZARD IN LUNAR ROVER OPERATION CREATED BY LIGHTING CONDITIONS 
AND GEOMETRY ON THE LUNAR SURFACE 


INTRODUCTION 

After the initial lunar base has been firmly established, well stocked, and 
is in the expected operating mode, explorations of the surrounding lurain 
will commence. Lunar rovers of various types will be used to support this 
exploration with distances from the base growing as capability and confi- 
dence of the lunar base crew increases. 

The explorer's ability to see on the lunar surface is strongly modified by 
the Sun elevation angle and by the azimuthal direction of travel for a given 
Sun elevation angle. The loss of "landmarks" (i.e., shadows vanish) due to 
increased elevation angle is well demonstrated by the simulation studies - 
and resultant photography- in Ref. (a) . Lunar illumination at high Sun 
elevation angles (viz., above 17° for fairly flat lurain) is harsh, glaring, 
and wipes out all shadows thoroughly. Unless preparation is made during the 
course of each early sortie, so that a network of artificial landmarks are 
emplaced, difficulties in navigation will ensue leading to serious acci- 
dents and/or death of the rover crew. 

ASSUMPTIONS 

1 . Exploration of the lunar surface will lead to lunar rover sorties 
at increasing distances from the lunar base. The open rover at 
distances up to 8 nm (13 km), the cabin rover at distances measured 
in hundreds of kilometers. Both of these extended types of sorties 
are evidently beyond walkback capability for astronauts. 

2. Exploration distances will increase to the extent that the full 
range of lunar surface lighting conditions will be encountered on 
many - and eventually almost all - lunar rover trips. This 
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excludes local travel to newly landed tugs, etc., in the immediate 
vicinity of the lunar base. 

3. Crevasses and weak- roofed "holes" exist in various parts of the, as 
yet, unexplored lunar surface. 

4. Location of all crevasses and "holes" will not be known for many 
decades, if ever. 



> 


THE MAJOR HAZARDS 

The major hazards identified are: 

1 . Failure to see a crevasse because of poor lighting conditions 
with subsequent entrapment of the rover and crew. 

2. Inability to navigate because natural landmarks are unseeable 
in poor lighting caused by high sun elevation angles - above 
17° from- either the eastern or western lunar horizons. 

ANALYSIS OF IDENTIFIED HAZARDS 


* 



Because the two hazards are so interrelated they will be treated simultane- 
ously in the analysis. 

Entrapment of the rover and its crew in a crevasse could occur far enough 
from the lunar base so that walking back to the base is out of the question. 
Entrapment could have occurred because rover motion during poor lighting 
conditions obviated seeing the crevasse beforehand. The Sun elevation 
angle is assumed to be greater than 17 degrees for this event. 

Effects of Hazards 1 and 2 


Loss of entire crew if not rescued. Oxygen will run out. 
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Corrective Measures 
Preventive measures: 

1. Develop method for locating, marking crevasses' locations. 

2. Information presently is insufficient for preventing rover 
entrapment by weak roof cave-in except by 'hole' detector. 

This would severely limit rover rate of travel on lunar sur- 
face unless an unmanned device preceded the manner rover 
over the path. 

3. Navigate via stars, if visible. Emplace lunar surface buoys 
during good seeing conditions. Buoy design must be indepen- 
dent of lighting conditions on lunar surface. 

Escape /Rescue Requirements 

Escape/Rescue requirements cannot be presently established for this case 
because of lack of information and data on lunar surface lighting condi- 
tions. 

RECOMMENDATIONS 

The following recommendations are made to alleviate this lack of knowledge 
noted above. 

1 . In general, not enough is known about navigation during high-Sun- 
elevat ion-angle-derived, poor lunar surface lighting conditions. 
Remaining Apollo lunar missions should incorporate experiments 
to collect data on lunar surface lighting and seeing conditions 
as functions of: 

a. Sun elevation angle independent of azimuth of travel. 

b. Sun elevation angle for various fixed azimuth angles. 

c. Gross roughness of the lunar surface. 
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2. Crevasse detection techniques must be developed as well as methods 
for detecting ’weak-roofed holes' - if they exist. Suggest 
experiment for Apollo rover lunar missions. 

3. Navigation methods should be developed to circumvent poor lighting 
conditions and permit seeing of obstacles in any lighting geometry. 
Use should be initiated on Apollo-rover lunar missions. Presently 
navigation without visual contact with the lunar surface - or using 
video - does not seem to be possible allowing, however, for one 
special type of case. In the latter, the rover crew has laid out 
lunar buoys (beacons) along its path while moving away from the 
base in a manner such that the straight line path between two con- 
secutive beacons has no obstacles of consequence to the passage of 
the rover. With each beacon coded so as to present a unique path 
and set of directions for the rover, the crew could return along 
this path without any external visual contact. This method might 
be termed a homing technique for navigation. 

Velocity techniques for navigation which include computing range, 
range to go, and position coordinates, or inertial or celestial 
methods are all equally useless navigation techniques since they 
do not account for obstacles in the rover traverse pathway. 

DATA SOURCE REFERENCES 

1. Apollo Illumination Environment Simulation and Study, Vol. II, 

W. K. Kincaid, Jr., S. Seidenstein, J. A. Janousek, NAS 9-7661; 
Biotechnology Organization, LMSC, for NASA/MSC. 



> 
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HAZARD STUDY 2 6 

SUMMARY OF SAFETY GUIDEIJENES CANDIDATES 


1. A device , analogous to mine detectors, must be designed in order to 
determine hidden crevasses and roofed holes on the lunar surface. 

This device, if needed, should be attached to the front of all lunar 
rovers on a long enough extension (truss) so that the rover may be 
stopped in time, at its highest speed, if such a hazard is detected. 

2. Navigation techniques must be developed for use on the lunar surface 
with lunar rovers, and with lunar flyers, which are independent of 
any and all lighting conditions on the surface. 

3. As aids to navigation on the lunar surface, 'buoys' should be developed 
containing coded radio beacons and flashing lights, and powered by radio- 
isotope power sources of at least five years' lifetime. Radio beacons 
should be detectable at a distance of at least 50 miles using omni an- 
tennas on the lunar rovers. 
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HAZARD STUDY 2T 

VISIBILITY CONSIDERATIONS IN DOCKING TWO VEHICLES (SPACECRAFT) 

IN LUNAR ORBIT 


INTRODUCTION 

During the course of prior activity in the Apollo program and Space Shuttle 
studies the phenomena of light ing/visibility in Earth orbit was recognized 
as an area for investigation as reflected in docking procedures. Because 
of the lack of light-scattering dust and atmosphere and because of lack of 
penumbra in shadowing, spacecraft are either in complete darkness or are 
illuminated by bright sunlight. Reflections from spacecraft surfaces are 
harsh and blinding. 

Visibility for docking is based on three factors: 

1. The geometry relating target spacecraft, docking spacecraft, the 
Sun and the Moon determines the illumination of objects within 
the field of view of the docking crew. 

2. The nature of the spacecraft surfaces and shapes which reflect the 
ambient illumination incident on those spacecraft. This determines 
contrasts within the field of view, particularly glare highlights 
and obscuration by shadow. 

3. Window position and field of view size and shape which interface 
with the first two factors and determine "Sun-shafting" through 
the window-viewports and scene veiling effects caused by scatter 
within the window media. 

Visibility considerations may constrain docking port location and orienta- 
tion and can effect the design requirements for the docking port area and 
its associated mechanisms. 
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ASSUMPTIONS 

a. Docking between any two spacecraft, in normal circumstances, 
can occur with: 

1) Both roll axes parallel and coincident. 

2) The roll axis of the active spacecraft is perpendicular 
to the roll axis of the orbiting lunar station. 

b. During routine operations the solar arrays of the orbiting lunar 
station are normal to the Sun’s rays and the station roll axis is 
parallel to the Sun's rays. 

c. Docking is normally accomplished in daylight. 

d. Docking is performed with the station in a zero-g flight mode. 

e. External station surfaces highly reflective (say — 50$), 
solar arrays 20$ reflective. 

f. Sky or dark lunar surface background with docking port illumi- 
nated by the Sun and some lunar reflection, or by the Sun only. 

g. Prior analysis for the shuttle docking-lighting geometry is 
used here while observing that the lunar spacecraft shapes 
will lead to different but closely related results. 

THE MAJOR HAZARDS 

The Major hazards identified are: 

1 . Docking attempts in daylight with spacecraft-Sun geometry not proper 
leads to multiple docking attempts, possible minor collisions. 

2. Side docking attempts with incorrect lighting relationships could lead 
to collision with solar arrays. This, in turn, would deny some or all 
solar-array generated electrical power to the orbiting lunar station. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazards Nos. 1 and 2 . Docking attempts with incorrect lighting 

geometry 
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Solar 1 Orientation: 

The hazard of collision exists because of attempts to dock when lighting 
geometry leads to poor seing conditions. During the course of contractual 
studies for NASA, lighting geometry was examined for Apollo docking and for 
the Launch and Reentry Vehicle (Shuttle to Space Station) docking procedures, 
Ref. 1,2. A current study to examine docking/lighting geometry for the 
Skylab program is also underway (Ref. 3). 

The results of these initial studies define a Sun angle, viz., the angle 
bounded by the docking (roll) axis of the active spacecraft and the inci- 
dence line of the Sun's rays (see Figure l); the positive angle being 
measured from the establish + X axis. It is assumed here that the roll 
angle for each vehicle is fixed with respect to the Sun line. 

Results of these studies - conducted as simulations using scale models - 
indicate that for Sun angles of less than 60 degrees. Sun shafting through 
the docking viewport or Sun incidence causing veiling (light scatter due 
to the viewport media) occur in present spacecraft. For Sun angles greater 
than 140 degrees, obscurance of the orbiting lunar station docking target 
and port by the shadow of the active spacecraft (e.g., a logistic tug) 
will occur. 

The effects of the simplification calling for a constant Sun angle for all 
spacecraft angles (roll angle with respect to Sun line) have not been ex- 
amined to date in the contractual simulation activities. Consequently, 
the effects of varying the spacecraft angle on lighting geometry are 
presently unknown. 

End-Port Docking with Orbiting Lunar Station in Normal Sun Orientation: 

Since the light geometry is very poor for end-port docking under normal Sun 
orientation - it is either too dark or too bright - any attempt to dock 
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under these poor seeing conditions will lead to either collision or multiple 
and therefore fatiguing attempts to dock (viz., Apollo 9 McDivitt/Schweikhart 
in LM, multiple tries to dock in bright sunlight with D. Scott in CSM) . Fa- 
tigue again presents the hazard of collision. 

Viewport filters or sunglasses do not aid the docking visibility because many 
of the (visibility) problems are derived from the extreme brightness varia- 
tions present in the visual scene. The eye adapts to the average brightness 
value of the visual field resulting in lack of visibility in the extreme 
(darkness or bright glare). Attenuation of light to the eye reduces the 
glare extreme, but results in proportionately reduced visibility at the dark 
extreme by reducing the energy reaching the eye to below its absolute sensi- 
tivity threshold. Docking lights have no significant effect within the 
feasible energy ranges (for such lights) because the amount by which they 
raise the luminous reflection from the dark areas is not sensed by the eye 
because the eye is adapted to a much higher brightness band in this 
situation. 

If the space station cannot be reoriented during docking, the dark-end docking 
port is unacceptable on the daylight side of the orbit while the Sun-end port 
is unacceptable because the Sun angle is ISO degrees. Both of these cases 
are outside of the Sim angle envelope; both give bad seeing conditions, the 
former literally leaves the pilot in the dark while the latter not only 
places the pilot in the glare due to reflection of Sun-light from station 
surfaces, but also may expose him to the glare envelope resulting from 
highly specular solar array cells. 

Corrective Measures for Hazards 1 and 2 

Preventive measures: 

1 . Reorient the orbiting lunar station as necessary during docking to 
yield acceptable Sim angles. 
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2. Limit docking at end ports to the dark side of the orbit, and use 
floodlights for illumination, since here the eyes can become fully 
dark adapted and the range of brightness in the visual scene is 
substantially reduced. 

3. Dock only at the side ports (90 degree Sun angle is fully accept- 
able) when on the daylight side of the orbit. 

4. A design alternative would be to have the end docking port - on the 

dark end of the station - angled at 45 degrees to the station center 

line. This yields a 135 degree Sun angle which is acceptable on the 
daylight side of the orbit. 

Escape /Rescue Requirements for Hazards 1 and 2 

No escape/rescue requirement exists for this hazard. 

DATA SOURCES REFERENCES 

1. Apollo Illumination Environment Simulation and Study, W. K. Kincaid, Jr., 

and L. M. Glasser, Biotechnology Organization, LMSC, NAS 9-7661, for 

NASA/NSC. 

2. Integral Launch and Reentry Vehicle, NAS 9-9206, LMSC-A9 59837, dated 
22 September 1969, for NASA/MSFC. 

3. Solar Illumination Environment Simulation (currently in progress at 
LMSC, Biotechnology Organization) NAS 9-11237, for NASA/MSC. Subject 
of this study is Skylab docking. 
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HAZARD STUDY 27 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1 . Daring daylight docking with an orbiting vehicle, the Sun line should 
be maintained within the limits shown on the accompanying sketch 

« (Fig. l). Specific geometry may narrow these limits in order to avoid 

glare or veiling. 

2. Problems of Sun orientation during docking may be avoided by completing 

* the maneuver on the dark side of the orbit while using artificial light- 



NOTE: The limits shown were obtained 

from lighting simulation studies 
at Lockheed Missiles & Space 
Company under contract to NASA. 



Definition of Docking Sun Angle for a Space 
Shuttle/Space Station Configuration 
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HAZARD STUDY 28 

LIGHTING AND VISIBILITY DURING LANDING 
(WITH LUNAR DUST EFFECTS) 


INTRODUCTION 

The dust layer on the surface of the Moon varies widely during LM landings 
based on the limited evidence from the three landings that have occurred to 
date. Armstrong's remarks just before touchdown to the effect that.... 'we 
are raising a little dust here,' amd Conrad's remarks about great obscuration 
while still several tens of feet above the surface serve to support that 
early conclusion (Ref. 1 , 2) 

The discussion in Ref 3 indicates that a veiling luminance can exist, due to 
sunlight striking the dust plume formed during landing, between the lunar 
surface and the viewer inside the LM. The sun also ill umi nates the lunar 
surface beneath the dust plume but such illumination is strongly attenuated 
by the dust plume leading to a decreased surface luminance. As the LM de- 
scends to a point close to touchdown the shadow of the LM and light trans- 
mission loss due to the dust plume yield poor viewing conditions. At a 
height from five feet above the surface down to two feet the lighting condi- 
tions deteriorate very rapidly until at two feet the surface is badly obscured. 

In addition to problems raised by sun illumination of the lunar surface at 
undesirable sun angles, there may be situations in which no sun illumination 
exists at all, that is, a night landing. The latter requires floodlights on 
the tug for use during landing. The optimum location of such floodlights is a 
tug design problem. 

The hazard of poor visibility when very close to the surface really focuses 
on whether or not a lunar rock (or deep hole) exists, where any of the foot- 
pads touch down, which will be sufficient in height (or depth) to cause the 
spacecraft to overturn or land at an angle precarious for lift-off procedures 
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later on. It is assumed that sufficient information exists beforehand to 

preclude any landing on so steep an incline that the tug will topple over 

upon landing. 

ASSUMPTIONS 

1 . The dust layer conditions at any new landing site on the lunar surface 
will be essentially unknown. 

2. Eventually, at the 'permanent' lunar base a prepared landing site will 
be available so that little or no dust will be raised on landing at the 
base. 

3. At the time that space tug landings commence on the lunar surface the 
lunar vertical indicators carried aboard the tug will be accurate to a 
small fraction of a degree. It is assumed that two such instruments 
are aboard, each independent of the other, and that tug pilots will 
believe their instruments. 

4. Whenever there are more than two crew members making a descent at least 
one of the crew will be assigned as an observer to aid the pilot during 
the last one hundred feet or so and to search for surface hazards. 

5. Given the choice, landings will occur under preferred sun lighting condi- 
tions. However, because of the possibility of rescue operations occurring 
at any time, landing capabilities must be independent of sun lighting 
conditions. 

MAJOR HAZARDS 

1. During the last few feet of the landing procedure the thruster(s) plume 
impinges on the lunar surface . This leads to visual obscuration of the 
landing site by virtue of the copious quantity of dust raised. The 
apparent (visual) landing geometry is therein distorted which may lead 
the pilot to set an incorrect attitude into the spacecraft resulting in 
the potential hazard of overturning on landing. 
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ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 . visual Obscuration by Dust 

The discussion in Ref. 1 includes a description of visual obscuration due to 
dust during the landings on the Apollo 11 and Apollo 12 Lunar Modules. 

Conrad's landing appeared to be precarious because he had great difficulty 
in seeing the lunar surface during the last 50 feet (approximately) of descent. 
(Ref. 2) He also stated that he had considerable doubt about his lunar verti- 
cal indicator's reading during that final landing interval, which suggests 
poor visual information since the indicator proved to be correct. The visual 
problem is a function not only of the dust cloud raised per se but also of 
sun lighting/elevation angle effects and spacecraft orientation with respect 
to the sun's rays. 

If the spacecraft touches down at incorrect attitude or velocity, it may over- 
turn or be damaged. Some of the crew may be injured. A lander footpad touching 
down on a large rock could also cause overturning or a precarious attitude for 
liftoff. 

Corrective Measures for Hazard 1 


Preventive measures: 

1 . Visual conditions are improved by conducting landings at relatively low 
sun angles with surface features in high contrast. A landing approach 
with the sun at the pilot's back should also be selected if possible. 

2. Great reliability should be built into the lunar vertical measurement and 
indicator system such that the pilots can have faith in the information 
displayed and have less need to depend on clear visual information. 

3. Since most tug landings will be conducted with more than two crew members 
on board, it should be advantageous to have one or more members acting as 
observers from the time the tug reaches 100 feet (approx.) altitude until 
touchdown. Essential 'landing adjustments' to avoid obstacles can be made 
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by the pilot as a result of receiving information from his observers. 
Remedial measures: 

1 . Measures to correct damage resulting from a bad landing charged to visi- 
bility will be no different from corrections for landing damage resulting 
from other causes. Some means for leveling a tilted lander should be 
provided. This may be accomplished by using jacks built into the landing 
legs or carried as auxiliary equipment aboard the tug. Rescue assist- 
ance may be required if the vehicle cannot be safely flown back to lunar 
orbit. 

Escape/Rescue Requirements for Hazard 1 

If, despite full attention to corrective measures noted above, the tug over- 
turns or is rendered inoperative on landing then the crew must be rescued. 
Some members may be injured. 

Effects of Hazard 2 . Landing at a Precarious Attitude 

The spacecraft can set down in a deep hole or on a large lunar rock even 
with good visual observation of the landing site. The LM in the Apollo 14 
flight did set down with one leg in a shallow crater ; the situation was not 
identified until the astronauts came out for their first EVA, (Ref. 4). 

With or without good visibility, ’roofed' holes or a crevasse obscured by 
loose lunar surface material are hazards not discernible by visual observa- 
tion. As a consequence, some other detection technique will have to be de- 
veloped if this phenomena presents itself. The roofed hole and covered 
crevasse is fairly common in Antarctica where much equipment and several 
lives have been lost in encounters with these hazards. The effects of this 
hazard are similar to Hazard 1 in that the spacecraft may overturn or be 
damaged as one footpad settles in a roofed hole or covered crevasse; some 
crew members may be injured. The spacecraft may be left in an undesirable 
attitude for liftoff. 
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Corrective Measures for Hazard 2 


Preventive measures: 

1. Methods for detecting and avoiding 'roofed' holes or local surface areas 
with low bearing pressure capability may need to be developed. 

2. It is recommended that dynamics studies of landing be performed in order 
to determine whether an abort or hovering maneuver can be automatically 
programmed to occur at any time the lander tilt attitude exceeds a pre- 
selected safe angle. 

Remedial measure for Hazard 2 are identical to those for Hazard 1 . 
Escape/Rescue Requirements for Hazard 2 

If, despite full attention to corrective measures noted above, the tug over- 
turns or is rendered inoperative on landing then the crew must be rescued. 

Some members may be injured. 

Effects of Hazard 3 . Night Landing Accident 

Because the actual occurrence of rescue situations cannot be predicted, and 
because any given rescue operation may take place independent of prevailing 
lighting conditions, the tug and its crew must be prepared to make night 
landings. When landing at night the tug crew will be dependent upon their 
instruments and artificial lights for guidance. Error may result in damage, 
overturn, or disabling of the tug on the surface and crewmen could be injured. 

Corrective Measures for Hazard 3 

Preventive Measures: 

1. Multiple flares used for night landings could be fixed so as to cast light 
on the landing area while the tug is still hovering and preferably used 
for several minutes before hovering itself ensues. 
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2. Floodlights should be mounted on the tug and oriented to provide optimal 
lighting of the lunar surface. 

3. It is suggested that portable lighting equipment be provided on all tugs 
so that the crew of a disabled tug on the surface - some of whose members 
are presumably uninjured - can lay out lights in a safe landing area. 

Remedial measures for Hazard 3 are the same as for Hazard 1 . 

Escape/Rescue Requirements for Hazard 3 

If the tug makes a faulty night landing which disables the tug, then its 

crew in turn will have to be rescued. 

DATA SOURCE REFERENCES 

1. Log of Apollo 11, NASA EP-72, Page 4, "4:05 PM (EDT) ... picking up some..." 
Aldrin/Armstrong at 30 ft. altitude at Tranquility Base). 

2. Aviation Week & Space Technology, November 24, 1969, Page 22, "...lot 
dustier then..." (Conrad commenting on dust in Oceanus Procellarum; 
altitude - 50 ft.) 

3. LM Soil Erosion and Visibility Investigations, Part 1, Summary Report, 

R. E. Hutton, 111 76-606-R0-00, TRW for NAS/MSC , August 13, 1969. 

4. Communications via CBS from Astronauts Shepard and Mitchell at beginning 
of EVA 1 during Apollo 14 mission. 
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HAZARD STUD! 28 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Provision shall he made in the design and planned operations of manned 
lunar lander vehicles to have crev members acting as observers commen- 
cing at 100 ft altitude to advise the pilot of surface conditions and 
obstacles. 

2. Routine lunar landings shall be planned with a preference for times of 
low angle sun lighting. In particular, landings at unexplored sites 
during lunar night, or times of high angle sun lighting, should be avoi- 
ded except for emergencies. 

3. Methods for detecting and avoiding 'roofed' holes, or local surface areas 
with low bearing pressure, during lunar landing shall be developed, un- 
less it can be shown that such hazards do not exist. 

4. Rescue landers shall be provided with flares and floodlights for use dur- 
ing night landings. 

5. Surface crews shall be provided with lighting equipment, signal devices, 
and radio beacons, as well as voice communication equipment for assisting 
a manned landing at their surface site. 

6. Surface crews shall aid incoming landers by site preparation and/or se- 
lection, identification of obstacles, lighting, and steering information 
where possible. 

7. The dyn ami cs of landing should be studied to determine whether an abort 
or hovering maneuver can be automatically programmed to occur at any time 
the lander tilt attitude exceeds some preselected safe angle. 

8. Means for leveling vehicles following landing on the lunar surface shall 
be provided. 
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9* The use of various optical filters in lander viewing ports should he 
tested in an effort to find means for reducing the effects of glare 
on vision. 


2-201 



LMSC-A984262C 


HAZARD STUDY 29 

COMMUNICATIONS ON THE LUNAR SURFACE 


INTRODUCTION 

During the course of lunar surface exploration various activities will occur 
outside of the base itself (i.e., out on the lunar surface). Lunar surface 
operations will involve landings from and departure to lunar orbit, opera- 
tions in small and large bases, surface EVA either in the base vicinity or 
from a rover or lunar flyer out on a traverse. The success of all of these 
operations is a strong function of the ability to maintain good communica- 
tions among all the elements of the system including those on the lunar sur- 
face, in lunar orbit and at the Earth. 

The communications system will provide the following functions : 

1. Navigation aid and position reporting 

2. Status monitoring of all elements 

3. Data/Information flow 

4. Engineering aid requests for experiments, vehicles, etc. 

5. Provides assurance of safety and well being for the crews. 

ASSUMPTIONS 

For small bases (e.g., Lunar Lander Tug) 

a. One or more men will be inside the base at all times. 

b. One or more men may participate in activity within 1 nm (less than 
2 km) of the landed tug in an EVA mode. 

c. Two or more men may be out in a small rover or lunar flyer a dis- 
tance of up to 8 nm ( 13 km) from the base. 

For the extended lunar surface base, similar conditions will hold along with 
the increased capability of this larger base: 
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d. One or more men will be inside the bs.se at all times, except in 
emergency situations. 

e. One or more men may participate in activity in the immediate vicinity 
of the lunar base; they may not be further away than one nautical 
mile (less than 2 km) from the base at any time. 

f. Two men may be out on a long traverse, in the cabin rover 270-400 nm 
(435-645 km) . Alternately, two men may be out in the small rover or 
lunar flyer a distance up to 8 nm (13 km) from the base. 

g. Either lunar base will have voice contact with mission control at 
Earth at intervals of one hour every day. 

h. Rovers and flyers will be based in pairs in the interest of having 
vehicles to go after crew members in a rescue or other situations. 

i. The lunar space station or an orbital tug will be able to provide 
communications relay services when the geometry involving it and 
the rover or flyer concerned is appropriate. 

j . Earth stations are available for communications relay at all times . 

THE MAJOR HAZARDS 


1. Failure of communications (receiving or transmitting or both) in flyers, 
rovers, or in the equipment of an EVA astronaut in the vicinity of the 
base, leading to isolation of the crew at a location not well estab- 
lished. This in turn results in the following: 

a. A lack of vital support and direction from the lunar bs.se 

b. No ability to call for aid, if needed 

c. Insufficient information at the lunar base to carry out a rescue 
mission if that is required 

d. This could lead to initiating an unneeded rescue mission. 

Effects of Critical Communications Failure 

1. Critical communications failure is assumed to be loss of ability to 

transmit or to receive or both. A crew on traverse is deprived of com- 
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munication support fl*om the base for navigation, function monitoring, 
and advice, while the base may be unable to receive a call for assist- 
ance. The base may lack information concerning crew location, particu- 
larly if the crew has continued to move since the last report or has 
headed back for the base following the failure. 

Corrective Measures 


A basic philosophy that is proposed for communications is that, except for 
operations where outside help or a safe haven are very near at hand (e.g., 

EVA within 1 nm of the base), a surface mission will be aborted following 
any failure reducing communication capability to one normal mode plus a 
backup. Thus a traverse mission beyond 1 nm would never start with less 
than one primary, one secondary, and one backup communication system. For 
the exception where help or haven are near at hand a primary system plus a 
backup would suffice, with the activity aborted following failure of either 
system. Contact may be direct or through orbital. Earth based, or lunar 
surface based relays as appropriate. Failure detection and warning must be 
provided . 

In the event of partial or total loss of communications while on a traverse 
with either type of rover or the flyer, plans shall exist concerning actions 
to be taken by the crew on traverse, by the lunar base, and by lunar orbital 
spacecraft and/or the Earth mission-control. In general, the loss of pri- 
mary or secondary communications will automatically lead to an abort of the 
mission. 

For a situation where communications are totally lost, plans will exist to 
ascertain whether or not a crew on traverse stays at a fixed location to 
await rescue or starts back to the lunar base under directions preplanned for 
that eventuality. Similar planning will exist for an EVA astronaut in the 
immediate vicinity of the base. 
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Escape/Rescue Requirements 

1. If the primary or secondary communications systems fail, the flyer's or 
rover's mission must be aborted. 

2. If all communications fail for an EVA astronaut on a rover or flyer 
mission, rescue is required. 
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HAZARD STUDY 29 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Each EVA astronaut in the vicinity of a lunar base shall have primary, 
secondary, and emergency backup communication systems. 

2. An EVA astronaut shall start a return to the base immediately following 
a failure of either primary or secondary communications. 

3. Each rover and flyer shall have independent primary and secondary com- 
munication systems. For traverses beyond 1 nm from the base, an emer- 
gency system shall be added. 

h. Rover and flyer traverses beyond 1 nm from the base shall be aborted 

immediately following any communications failure which reduces the total 
capability to two transmitters and two receivers. 

5- Plans for action to be followed in the event of partial or complete com- 
munications failure shall be prepared prior to any mission. Plans will 
be revised as necessary during the mission. 


* 



1 • 
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HAZARD STUDY 30 

COMMUNICATIONS ASSOCIATED WITH SPACECRAFT IN LUNAR ORBIT 
INTRODUCTION 

The establishment of high grade, reliable communications is basic to the 
operation of manned spacecraft in lunar orbit. Such communications will be 
carried not only among spacecraft in lunar orbit and to Earth stations but 
also, once surface missions start, with vehicles and bases on the lunar 
surface. Eventually, surface traffic will appear on the far side of the 
Moon. This will then increase the need for communications facilities in 
lunar orbit and/or require a comsat at the libration point. 

ASSUMPTIONS 

1. Early communications following manning of an orbiting lunar station will 
be carried out among lunar orbital spacecraft and Earth stations. After 
about 6 months of activity in lunar orbit, sorties to the lunar surface 
will be initiated at regular intervals and communications will be ex- 
panded to include the surface activities. 

2. Each orbital spacecraft has a minimum of two independent communications 
systems , following past and current practice for manned spacecraft sys- 
tems. Additionally, astronauts that engage in EVA from the spacecraft 
will have a primary and a secondary communications system. 

3. No situation ever exists which causes all lunar orbital spacecraft to 
lose all of their communications simultaneously. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. An EVA astronaut has a malfunction of his primary and secondary communi- 
cations system leading to isolation of all information about him from the 
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lunar space station or other spacecraft from which he egressed. The 
astronaut cannot call for aid if he needs it, except by the use of hand 
signals if he is in sight of personnel aboard his monitoring spacecraft. 

2. One of the space tugs in lunar orbit loses all of its communi cations 
capability; as a consequence other lunar spacecraft whether on the sur- 
face or in orbit can no longer send or receive information to or from 
that tug. The tug cannot call for aid or information if needed. This 
would be a crucial situation should a rescue be underway. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard l t EVA Astronaut's Communications Loss 

Loss of communications leads to a lack of information exchange between EVA 
astronaut and the spacecraft from which he is operating. The information in- 
cludes both voice communication and monitoring of the vital signs (life func- 
tions) of the astronaut, thus knowledge about astronaut well-being is not 
constantly available. Nor can the astronaut call for aid if he should have 
such a need. Hand signals could occasionally alleviate the latter problem. 

Corrective Measures for Hazard 1 


Preventive measures: 

1. Provide two independent, highly reliable, communications systems for 
each EVA astronaut. 

2. Communications should be continually monitored by crewmen in tug or 
space station. 

3. Use the EVA buddy system. 

4. Check communications at frequent, fixed intervals. 
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Remedial Measures: 

1. Provide an automatic alarm in case of circuit failure in either voice 
or vital signs monitoring. 

2. The EVA astronaut should return to the station immediately following 
knowledge of failure of either primary or secondary communications. 

3. Separately powered blinker light signals should be used to indicate 
distress. 

Escape/Rescue Requirements for Hazard 1 

Primary measure is for EVA astronaut and monitoring spacecraft to recognize 
lack of communications and to get a signal to the astronaut to tell him to 
return to his spacecraft immediately. If astronaut* s alarm does not work, 
and a light signal or jerk on the tether does not alert him, then another 
astronaut is required to go out and get the crew member whose system has 
failed. 

Effects of Hazard 2 . Loss of Communications in a Space Tug in Lunar Orbit 

Communi cations are lost by a space tug due to a hardware failure within the 
subsystem or a failure generated by a meteoroid strike. As a result, the 
tug crew is isolated from all other personnel in the lunar complex so that 
the crew's well being is in doubt. The crew can neither ask for nor receive 
directions for the activity that they are engaged in during the communica- 
tions blackout. Should this particular tug suddenly be needed for an urgent 
operation it will not be available since it cannot be called via the com- 
munications net. If such a loss occurred during a rescue mission, the 
rescue itself will be endangered. 

Corrective Measures for Hazard 2 

Preventive measures: 
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1. Provide independent, highly reliable primary, secondary, and tertiary 
communication systems on- each space tug. 

2. Check communications at frequent, fixed intervals. 

3. Carry critical spare parts, and schedule preventive maintenance 
and replacement. 

Remedial measures: 

1. Provide on-board repair or replacement capability. 

2. Return the tug to the orbiting space station for repair following 
failure of any one communication system, if on-board repair capa- 
bility is not adequate. 

3. Provide coded external light beacons on the tug for emergency backup 
signals . 

Escape/Rescue Requirements for Hazard 2 

None required. 

Further Discussion 

A communications loss for the lunar space station is not deemed to be a major 

hazard because of the following: 

1. The station will have a multiplicity of communications systems aboard 
which are independent of one another. 

2. The antennas for these communications systems are expected to be widely 
separated on the station and there is expected to be duplicate antennas. 

3. All communications systems (as is true for other subsystems) are expected 
to be checked out on a regular basis with preventive maintenance applied 
as required to keep all subsystems operational. 
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4. The lunar space station is expected to have multiple spares aboard for 
all critical parts of the communications system. Some repair capability 
is expected to be available in the station as well. 

5. In the unlikely event that all of its radio communications fail, the 
station could operate its communications from a tug docked to it. 
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HAZARD STUD! 30 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1. Each EVA astronaut shall have independent, highly reliable primary, 
secondary, and emergency backup communications systems. Loss of the 
primary system yields an immediate and mandatory requirement for the 
astronaut to return to his spacecraft. 

2. For circuit failure of his primary communications system, it is recom- 
mended that an independent alarm be set off for the EVA astronaut. 

3. It is strongly recommended that EVA activity be carried out using the 
buddy system, or the presence of a safety man. 

U-o Communications with an EVA astronaut shall be monitored and checked at 
frequent fixed intervals by a crewman in the nearby tug or space station. 

5* Provision shall be made to signal an EVA astronaut that his communications 
have failed. Suggested signals are lights and jerks on the tether. 

6. Each communication system shall be checked at frequent fixed intervals. 

7. Each space tug shall have a minimum of three independent, highly reliable 
communication systems. 

8. All space tugs shall have external beacons (lights) for use as a backup 
signalling device. 

9. Each space tug in lunar orbit shall be able to dock to the space station 
in order to re-establish communications by using the station facilities, 
or by having repairs made to its own system, or by a combination of these 
methods . 

10. The tug shall be returned from an orbital mission to the orbiting lunar 
station for repair following any communications failure that cannot be 
corrected on board. 

11. The lunar space station shall have some capability to perform scheduled 
maintenance, and repairs and replacement for communications subsystems. 

12. Space tugs should be designed to be able to act as the emergency communi- 
cations center for the lunar space station. 
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13. For each specific type of failure a 'flight' plan shall be prepared 
giving the course of action to be followed for each eventuality. These 
plans shall be a function of the kind of failure (e.g., lifetime ex- 
ceeded, meteoroid strike, collision with orbital debris, etc.), the loca- 
tion of the spacecraft, the operational scenario, the degree of avail- 
ability of external assistance, etc. 
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HAZARD STUDY 31 

RADIOLOGICAL HAZARDS - NATURAL AND MAN-MADE 


INTRODUCTION 

The innate curiosity and inquisitiveness of man, which, through the ages has 
driven him into the exploration of regions beyond his local horizon and 
sphere of knowledge, has also continually exposed man to new and often 
hazardous environments. Sometimes, when the new environment and acquired 
knowledge are useful he carries it with him into further quests and ventures 
as in the case of new energy sources upon which he can rely for survival and 
transport. Thus, he must often reassess the sum total of his hazard burden, 
the hazard potential of the things he takes with him and the potential 
hazards he faces in a region that is new and of which he has only very 
limited knowledge. 

This study area considers the natural and man-made radiological hazards 
associated with manned exploration operations in the lunar environment. 

ASSUMPTIONS 

1. The natural primary radiation environment in lunar orbit and on the 
lunar surface is taken to be as defined in NASA TM X-53865. Solar 
particle event data is to be taken from the same reference work (Ref. l) 

2. It is assumed that the man-made sources of hazardous ionizing radiation 
employed in lunar exploration will consist of the following: 

Microwave equipment 
Laser equipment 
X-ray equipment 

Radioisotopic power generators 
Nuclear power plants 

3. It is assumed that for the normal operating situations, all man-made 
sources of hazardous ionizing radiation are adequately shielded, 
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contained, or oriented, such that essentially no dose is delivered to 
operating personnel or personnel in the vicinity of the operating device. 

4. For a given crew, it is assumed that solar flare dose effects (where 
applicable) are accrued in the first several days of the crew tour of 
duty. 

5. Crew exposure limits utilized for the analysis are the "anticipated crew 
radiation limits" currently being considered by the NASA-Radiation Con- 
straints Panel as a revision to the "Provisional Radiation Dose Limits 
for Manned Space Flight Beyond Apollo." (Ref. 2) 


The hazard generators considered in this study area are necessarily restricted 
as to energy type and are discussed only in terms of general attributes. The 
generators of concern are as follows: 

1. Natural sources: 

a. Galactic cosmic radiation 

b. Solar flare particle radiation 

The characteristics of (and the distinction between) galactic cosmic 

radiation and solar flare particle radiation is given in Table 1. 

2. Man-made sources: 

a. Electromagnetic radiation - as encountered from microwave, laser, 
and x-ray radiating equipments. 

b. Nuclear Radiation - consisting of high energy alpha, beta and g amma 
emissions from unstable isotopes, whether the product of a fission 
process or simply the decay of a radioisotope species. 

c. Radiological Contaminants - as characterized by the release to the 
environment of nuclear isotopic materials either as mixed fission 
products (gases and/or solids), or, as specific isotopic species. 
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Biological effects Primarily chronic; perhaps some Primarily acute damage; possible 

vital cell destruction. sudden illness, incapacitation, 

or death. 
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THE MAJOR HAZARD 

The major hazard which can potentially be generated by the natural space 
radiation environment and man-made nuclear energy conversion devices is the 
exposure of man to levels of high energy radiation which could expend or ex- 
ceed established crew radiation exposure limits. The magnitude of the po- 
tential hazard ranges from small incremental increases in crew total radia- 
tion exposure to large dose burdens which could be physiologically intoler- 
able to the crew's health and well being. 

ANALYSIS OF THE MAJOR HAZARD 

The major hazard of concern then is the exposure of man as a biological en- 
tity to ionizing radiation which is known to degrade and produce injury at the 
basic molecular and cellular level in the human organism. The most singular 
attribute of the radiation exposure hazard is that the presence of a radia- 
tion field is normally not apparent to man. In fact, its presence cannot 
usually be sensed by man until the energy input involved is well into regions 
where exposure has already begun to fatally injure the man. Fortunately, 
however, man has learned to detect the presence of radiation with a wide 
variety of detection instruments which can sense and measure the type and 
intensity of the radiation field. Man is therefore very much dependent upon 
such instrumentation to keep him aware of the radiation environment around 
him. A second and very significant attribute of the radiation exposure hazard 
derives directly from the practically instantaneous rate changes which can 
occur in exposures from malfunctioning or breached man-made sources. A 
similar attribute is characteristic of solar flares, although the rate changes 
are a matter of minutes rather than milliseconds. 

The principal exposure mechanisms which present a potential radiation hazard 
are the following: 

1. Natural Sources - 

a. Galactic Cosmic Radiation - a relatively constant flux of low intensity 
and isotropic distribution. 
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b. Solar Particle Events - sporadic proton showers resulting from sudden 
anrl sometimes unexpected solar flare activity. While sun activity 
cycles are generally known, specific flare activities within the 
cycle are unpredictable. A worst case situation would be a prolonged 
flare exceeding 1-2 days with unexpected intensity magnitudes. 

2. Man-Made Sources - 

a. Microwaves - exposures to beam power densities close to or exceeding 
.1 watts/cni producing a thermal biological response. 

b. X-Rays - Faulty shielding of high power electron tubes (Klystrons, 
etc.). Cumulative stray exposure from x-ray type analytical tools. 

c. Laser Beams - inadvertent exposure to high energy beam or pulses of 
laser type equipments. Exposure of eyes to moderate energy beams of 
low intensity laser equipment. 

d. Radioisotope Thermoelectric Generators (Ref. 6) - 

(1) Alpha Emitters (Plutonium-238, Curium-242 , or Polonium-210) - 
Burns resulting from inadvertent contact with heat capable 
during assembly; or. Alpha contamination resulting from rupture 
of heat capsule. 

(2) Beta Emitters (Strontium-90) - Exposure to gamma radiation if 
RTG shielding is breached. Beta emitter contamination if 
source capsule is ruptured. 

e. Nuclear Electrical Power Systems (Ref. 7) - 

(1) Ambient radiation environment around reactor compartment. 

(2) Loss of Reactor compartment shield integrity. 

(3) Leakage of fission products into heat transfer system outside 
of reactor shield. 

The Hazards Effects 


The effects of the major hazard upon man have been extensively studied for 
a number of years. A recent work (Ref. 5) has rather tho roughly examined the 
effects of radiation upon man as such effects relate to manned space flight. 
The authors concluded that, practically speaking, a "threshold of damage" 
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concept for radiation effects upon man does not per se exist, and further, 
that any amount of radiation contributed in some extent to "life shortening" 
for man. Hence, any "exposure limits" criteria would have to reflect the 
concept of - "the price you want to pay for the activity you want to accomp- 
li sh"-type of philosophy. While this is probably true in the absolute sense, 
there is also available other data which indicate that for select populations 
working to controlled radiation exposure limits, there has been no notice- 
able difference in general longevity or general health. 

Based upon available information from many sources, the NASA-Radiation Con- 
straints Panel has set forth a table of values for allowable crew exposure 
limits published as the "Radiation Dose Limits for Manned Space Flight in 
Skylab, Shuttle, and Space Station/Base Programs" (Ref. 9). 

TABLE 2 

RADIATION EXPOSURE LIMITS AND EXPOSURE RATE 
CONSTRAINTS FOR UNIT REFERENCE RISK (rem) 


EXPOSED AREA 
DEPTH 

1 YR. AVG. 
DAILY 

30 DAY 

QUARTERLY 

YEARLY 

CAREER 

SKIN (0.1 MM) 

0.6 

75 

105 

225 

1,200 

EYE (3 MM) 

0.3 

37 

52 

112 

600 

TESTES (3CM) 

0.1 

13 

18 

38 

200 

MARROW (5 CM) 

0.2 

25 

35 

75 

400 


Table 2 provides the measurement basis for evaluation of the radiation exposure 
rate-time effects upon the crew in terms of total exposure accountability. 

1. Natural Sources Effects: 

The exposure of lunar exploration personnel to the lunar ambient cosmic 
radiation fields and the effects of solar flares upon cumulative crew 
dose burden may be estimated utilizing data from the NASA TM-X-53865 
(Ref. l) . Figure 1 presents a plot of the Ref. 1 data superimposed upon 
the crew exposure limits taken from Table 2. The data are given for the 
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nominal cosmic radiation field and for the nominal cosmic radiation field 
plus a solar flare event. The curve assumes that the solar flare occurred 
on the first day of crew residence in lunar orbit. The effects of two 
different shielding densities are included in the data. Figure 1 rather 
pointedly illustrates the necessity for a well shielded "storm cellar" 
for limiting crew dose from solar flare events. It is quite likely that 

O 

shielding in excess of 10 gm/cni will be required for the "storm cellar" 
shelter area as a guard against multiple successive solar flare occurrences. 

2. Electromagnetic Radiation Effects: 

Devices such as microwave and laser generators are normally capable of 
beam power output values greatly in excess of safe human exposure limits 
even when operated at low power levels. For example, a value of .1 watt/ 
cm for microwave will produce thermo-biological effects (cooking) in the 
human body from beam absorption. The normal allowable exposure is .01 
watts/cm for an unshielded man. For lasers operating in the visible 

—5 

light range (0.4 um to 1.4 M m ) » the threshold for eye damage is 1 x 10 - 

2 62 

watt/cm ( CW mode ) and 1 x 10 joule/cin for the pulsed mode. 

3. High Energy Radiation Effects: 

Devices which generate radiative energy at wavelengths smaller than 10 ^mm 
produce ionizing radiation of increasing energy content as the frequency 
gets smaller. This phenomena begins with UV, and becomes more pro- 
nounced as the x-ray and gamma ray wavelengths are approached. Since the 
wavelength becomes miniscule it is customary to refer to penetrating ion- 
izing radiation in terms of its energy. The only real difference between 
x-rays and gamma rays is the photon energy content and the fact that x-rays 
can be produced by electron bombardment of a heavy metal target and gamma 
rays are normally the product of a nuclear state decay or disintegration 
event. For both x-ray and gamma ray emitters the amount of shielding re- 
quired is dependent upon the photon energy and the device is shielded 
against the strongest photon it emits. 

The effects of x-ray and gamma ray exposure have been studied extensively 
and accurate dosimetry techniques are readily available for sensing and 
measuring human exposure in terms of any part of the energy spectrum. 
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Crew Exposure Limits and the Predicted Lunar 
Natural Radiation Environment 



• EFFECTS OF ACUTE WHOLE-BOUT EXTERNAL RADIATION EXPOSURE AND PROBABLE THERAPY (REF. 8) 
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STATISTICS OF EARLY EFFECTS - ACUTE WHOLE BODY IRRADIATION (REF. 2 
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PERCENTAGE OF EXPOSED PERSONNEL AFFECTED 
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Exposure accounting techniques are also well developed which provide for 
each crewman his total exposure burden at any time based upon his sensor 
badge and dosimeter readings. 

4. Particle Radiation Effects: 

For devices such as radioisotope thermal generator sources and nuclear 
fission sources there are additional energy sources to be considered. A 
radioisotope may decay by the emission of an alpha particle (helium nuclei), 
a beta particle (positron) and/or gamma rays. Normally the source en- 
closures are sealed and of sufficient thickness to stop or absorb alpha 
or beta particles. However, should the enclosures be damaged or breached 
it is possible to release the isotope source material into the local en- 
vironment with serious contamination and exposure problems ensuing. 

The problem of radiation exposure associated with a nuclear power gener- 
ator (employing a fission reactor) have been examined in another study 
area and the reader is referred to Ref. 7 for study details. 

5. Gross Exposure Effects: 

The major impact of ionizing radiation upon living cells of the human body 
is the fact that some degradation of the collective cell structure will 
occur each and every time an exposure occurs. The collective cell struc- 
ture tolerates and adapts to the low radiation levels found over the 
Earth's surface. Exposure to higher levels of ionizing radiation over 
periods of time has been demonstrated to be deleterious to human health 
as evidenced by numerous medical studies (Ref. 5) . Exposure to very 
high radiation levels even for short periods of time can place the human 
organism in dire jeopardy as indicated in Tables 3 and 4» The generalized 
effects of large radiation exposures to crew personnel may be inferred 
from the data presented in Figure 2. The figure presents the radiation 
dose versus time since exposure occurrence and provides a rough measure 
of the degradation of personnel capability with time after exposure. 
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Corrective Measures 
Preventive Measures: 

1. The principal means of controlling crew exposure to the natural sources 
of radiation will be the shielding afforded by the orbiting lunar station, 
the crew modules, the lunar surface base and the cabin- type rover for 
surface activity. 

2. Protection from the man-made radiation sources must be afforded as an 
inherent part of the source design. For those sources employing isotopes, 
fission products, or fissionable materials, double containment must be pro- 
vided to preclude spillage, leakage, and the contamination of the local 
environment. (Ref. 9) 

3. It must not be possible for crew personnel to activate or energize micro- 
wave, laser, or x-ray equipments from positions which expose them to the 
output of such equipments. 

Remedial Measures: 

1. Remedial corrective measures for countering the effects of overexposure 

to the several types of ionizing radiation are largely of a medical nature. 
Hence, the Orbiting Lunar Station will be required to maintain in the 
medical kit an adequate minimum supply of emergency treatment drugs and 
reagents. 

Escape/Rescue Requirements 

In view of the lack of established guidelines for action to be taken in the 
event of sudden overexposure to high energy ionizing radiation, the following 
tentative guidelines are proposed for consideration: 

1. For individual crewmen involved j 

a. Up to 25 REM - Station duty only and Earth return at end of normal 
duty tour 

b. In excess of 25 REM but not over 75 REM - Under medical surveillance 
with possible light duty and Earth return at next opportunity 

c. In excess of 75 REM - Emergency treatment and prompt return to Earth 
via tug. 
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2. For more than two crewmen involved; 

a. For exposures in excess of 75 REM - Requires immediate return of 
exposed personnel. 
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(Report of the Space Radiation Study Panel), National Academy of Sciences, 
National Research Council, Washington, D. C. 1967. 

6. "Guidebook for the Application of Space Nuclear Power Systems," Atomic 
Industrial Forum, January 1969- 

7. "Hazardous Operations In and Around The Orbiting Lunar Station - Nuclear 
Power Plant," Study Area 4-5, Lunar Mission Safety and Rescue Study, LMSC, 
11 December 1970. 

8. Air Force Systems Command, Design Handbook 1-3, Personnel Subsystems, 
Chapter 3, Section 3-D- , Radiation (Design Note 3D2) . 1st Ed. Rev. 3 
1 January 1969- 

9. "Radiation Dose Limits for Manned Space Flight in Skylab, Shuttle, and 
Space Station/Base Programs", NASA - R. G. Rose, Chairman, Radiation 
Constraints Panel, memo dated Jan. 15, 1971. 

10. The applicable sections of Title 10, Chapter I of the Code of Federal 
Regulations, (viz Parts 20, 32, 33, 40, 70, and 71) shall be considered 
as basic source data. 
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HAZARD STUDY 31 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Consideration of "crew radiation-exposure accountability" must be in- 
cluded in the administrative procedures devised for lunar exploration 
mission planning. It must be possible to update each crewman 1 s exposure 
record at least once each 24 hours. 

2. Serious consideration shall be given to the implementation of a mission 
planning function which will thoroughly evaluate the "crew radiation 
exposure potential" for each phase and activity of the planned missions. 

3. Specific crew safety studies shall be required for each item of mission 
equipment capable of emitting ionizing radiation. The studies shall be 
conducted in the context of the mission(s) for which the equipment use 
is intended. Where several such equipments are to be employed, the 
study shall account for the sequential and/or simultaneous use of the 
involved equipments. 

4. All nuclear and isotope source units shall have been demonstrated to be 
safely contained against impact, weldment leakages, or containment melt- 
through, prior to flight qualification. Where the unit is to be employed 
continuously in close proximity to crew quarters and shelters, the unit 
shall be doubly contained to avoid all possibility of leakage and local 
environment contamination. 
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HAZARD STUDY 32 

LUNAR SURFACE PHYSICAL CONDITIONS 




* 





INTRODUCTION 

The subject of lunar surface physical conditions as a source of hazards to 
lunar exploration personnel is one in which the desk-bound analyst is con- 
siderably at a disadvantage. The only human beings to experience first-hand 
the impact of such physical conditions are the Apollo astronauts. And need- 
less to say, while the lunar samples returned have been priceless as sources 
of basic composition information, it is impossible to extrapolate from a 
box of rocks to surface structure. However, we do have an immense quantity 
of photographic data from the Ranger, Orbiter, Surveyor and Apollo missions 
which has provided coverage of various kinds of quality for all but a small 
percentage of the lunar surface. Thus, it is primarily this photography and the 
the Apollo descriptions (Ref. l) from which we can at least visualize some 
of the problems which surface explorers may encounter. 

ASSUMPTIONS 

1. Photographs which are currently available reasonably represent the 
seleneology of the lunar surface. 

2. Considering the limitations of the seleneological data available to date, 
including soil mechanics and characteristics observations, it is possible 
that other lunar regions may exhibit characteristics entirely different. 

The possibility of surface crust-like formations, sub-surface cavities, 
vent-gas blow holes, etc., cannot be presently ruled out. Nor is it 
possible to confirm or rule out, as yet, the existence of active venting 
sites where lunar outgassing may be observed. 
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THE MAJOR HAZARDS 

The major hazards to lunar exploration personnel associated with lunar sur- 
face physical conditions considered to be of significance are as follows: 

1 . Lunar Dust 

2. Lunar Lighting Phenomena 

3. Lunar Soil Mechanics Variation 

4. Topographical Natural Barriers 

5. Meteoroid Strike Frequency 

ANALYSIS OF IDENTIFIED HAZARDS 
Effects of Hazard 1 . Lunar Dust 

The impact of lunar dust in manned exploration of the lunar surface has 
already gained prominence as a troublesome hazard as recorded in the mission 
reports of the Apollo 11 and 12 crew manhours. That the problem will become 
more severe with the advent of larger landing vehicles, large rovers, and 
dual landing requirements, etc., is a foregone conclusion. 

Specific effects noted to date have included suit contamination, experiment 
contamination, and landing craft contamination including cabin atmosphere. 
The dust, further, was carried into the command module. (Refs. 1 and 2) 

A concomittant train of contamination is evident and applicable to the pro- 
posed tugs and orbiting lunar station (OLS). 

The ingestion of lunar dust in any appreciable quantities is likely to be 
serious from a health standpoint considering the accumulated findings of 
dust inhalation studies conducted for various earth mining and ore smelting 
operations. The impact of lunar dust upon rotating and moving machinery is 
certain to affect rover and surface mobility aid equipment design in the 
protection of mechanical parts and in providing assurance of visibility for 
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the operation. Until more is known of the dust depth over various regions 
of the lunar surface, it must be assumed that deep dust pockets could occur 
which might contribute to the engulfing or entrapment of personnel or equip- 
ment. 

The employment of large landing vehicles having multiple engines has been 
postulated as being capable of creating veritable lunar dust storms in the 
immediate area of the landing site. Postulated separation distances for dual 
or sequential landings are currently on the order of one to one and a half 
miles in order to protect the other vehicle from the sandblasting effects 
of thrust plume impingement, ejected dust, and small rocks. If such is the 
case, then a tug rescue of exposed suited crewmen would be further compli- 
cated by the tug landing separation distance requirement. 

Corrective Measures for Hazard 1 

Preventive measures : 

1. A design requirement exists for the development of a dust collector ap- 
plicable to cleaning dust from space suits, equipment surfaces, etc., 
in external lunar environment conditions. The principle upon which to 
base such a collector (electro-static, etc.) is not readily apparent, 
therefore a development requirement also exists. It would be advantageous 
to improve the design of equipment so that it is not affected by lunar 
dust. However, establishing a rule for vacuum cleaning of suits and 
equipment in airlock before entry into main areas would appear to be 

more cost-effective and safer. Suits and equipment must be cleaned in 
any case before entry, and dust in the atmospheres of the LSB, tugs or 
surface vehicles would be, at the very least, an irritant to membranes 
of the respiratory system. 

2. A design and development requirement also exists for dust seal applica- 
tions on both static and moving equipment components and assemblies em- 
ployed in lunar surface experiments and mobility aids. 
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3. The effects of dust cloud size, dispersion distance, and density result- 
ing from large lander landings must be evaluated in terms of potential 
constraints imposed upon surface rescue missions. 

Remedial measures: 

1. Provision of small atmospheric vacuum cleaner in atmosphere containing 
shelters, air locks and crew compartments to trap surface dust from suits 
in a self-closing contained filter bag or chamber. 

2. Provision of two 100 ft. rolls of 3 foot wide highly visible foil with 
anchor pins or weights to serve as rescue location marker (X) providing 
reference point for landing separation distance estimation by lander 
crew in a daylight landing. 

Escape/Rescue Requirements for Hazard 1 

None are postulated due to exploratory nature of study. 

Effects of Hazard 2 . Lunar Lighting Phenomena 

The effects of lunar lighting conditions upon personnel activities have been 
noted in some detail in the reports of the Apollo 11 and 12 missions. The 
importance of sun elevation angle for lunar landings is discussed in Ref. 2 
and in Hazard Study 28. 

The effects of sun elevation will strongly influence not only landing opera- 
tions but surface activities as well. It has been reported that the opera- 
tors of Russia's Lunokhod-1 have experienced visual difficulty at sun angles 
less than 30° when long shadows tended to obscure small craters and crater 
depths (Ref. 4) • It may also be expected that the exploration of large 
craters such as Tycho or Copernicus are going to be lighting-condition con- 
strained and will require photographic coverage to obtain sun angle versus 
crater floor obstacle definition data prior to any attempted landings on the 
floor . 
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Rescue missions will also be constrained by lighting conditions prevalent in 
the vicinity of the attemped rescue. Particularly, if some search effort is 
required to find the distressed personnel. For periods of direct overhead 
sunlight (90°), it will be extremely difficult to find either vehicles or men 
in the "wash-out" created by lunar surface back reflectance of light. 

Corrective Measures for Hazard 2 


Preventive measures: 

1. The potential use of polarizing filters to attenuate reflected light 
from the lunar surface. 

2. The potential application of heliograph type* signalling devices for 
distressed surface personnel use as a beacon or even for communication. 

3. The use of simplified radar ranging equipment to aid in surface rover 
navigation during unfavorable sun angle periods. 

Remedial measures: 

1. Provision of a mirror, flare gun, and emergency radio transponder beacon 
in all emergency kits for parties on surface sortie of any type. 

2. Provision of radar reflecting deployable foil in all emergency kits for 
surface sortie personnel utilization. 

Escape/Rescue Requirements for Hazard 2 

None postulated for this study area. 

Effects of Hazard 3 . Lunar Soil Mechanics Variation 

The variation of lunar soil types and condition over the surface of the Moon 

are largely unknown. However, certain kinds of lurain formations such as 

* An instrument for telegraphing by means of the Sun's rays reflected from a 
mirror. It has been adapted for use in the dark with its own lamp. 
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steep banks, slumped soil areas and rocky mountainous or hilly regions do 
have familiar counterparts on Earth. The obviously slumped soil formations 
lining the crater ruins of Tycho, Copernicus, and other great craters may' 
well behave like avalanches if sufficiently disturbed by the rocket engine 
vibrations of a landing tug descending to the floor of the crater. Or, if 
disturbed by a moon quake having its origin in nearby regions. The steep 
banks of most craters and some rilles are likely places also to encounter 
engulfing avalanches of sliding soil if untethered descent were to be at- 
tempted. 

The exploration of mountainous regions by suited crewmen is likely to be 
limited only to those sites where a lander can be set down, since current 
suit technology permits neither long time sorties nor the high metabolic 
rates associated with mountain climbing. Hilly regions may be navigable by 
a large rover at least to the extent that the winding valleys can be pene- 
trated. The problem of unknown variations in surface soil structure will 
only become known by surface exploration. Such phenomena as surface crust- 
ing with variable load support strength, and the possibility of sub-surface 
cavities, may exist in the regions which are thought to be volcanic in 
origin. The detection of these soil surface and sub-surface formations re- 
quires both seismic and sounding equipments as well as surface penetrometer 
measurements. Visual evidence of such phenomena may well be obscured by 
lunar dust layers. Evidence of fault bridging, a form of crusting, may only 
become apparent when the exploring vehicle falls through the bridging soil 
crust, unless suitable detectors are available. 

Corrective Measures for Hazard 3 

Preventive measures: 

None postulated due to lack of specific soil problem data. 
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Remedial measures: 

None postulated due to lack of specific data. 

Escape/Rescue Requirements for Hazard 3 

None identified due to the general nature of this study area, but soil 
mechanics may well generate a situation requiring rescue. 

Effects of Hazard 4 . Topographical Natural Barriers 

The natural barriers which are of importance to surface travel are readily 
apparent from lunar maps which include elevation measurements. Most of the 
major craters appear to be in the group requiring lander operations for 
accessibility to both rims and floor areas. Surface equipments simply could 
not scale the heights on such rugged terrain. Other lunar prominences in- 
clude mountains which on the near side of the moon reach up to 39, 500 feet 
in altitude. No doubt there are equivalent heights or higher on the far 
side. Such mountains could pose a hazard if a planned landing trajectory 
were to cross the region at low altitude. 

Corrective Measures for Hazard 4 


Preventive measures: 

1. Operational planning for both descent from orbit and for surface activi- 
ties must include detailed information relative to the natural lunar 
surface formations with respect to elevation, shortest path around 
barriers, and regions where accessibility is restricted. 

Remedial measures: 

Not applicable to this study area because of lack of mission data. 
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Escape/Rescue Requirements for Hazard 4 
Not considered for this study area. 

Effects of Hazard 5 . Meteoroid Strike 

This hazard requires further study due to the lack of definitive data. The 
relative frequency of surface meteoroid strikes could well be different for 
definable regions of the Moon and may well be influenced by the regions of 
meteoroid origin. Therefore, the hazard is only set forth as a subject re- 
quiring further study prior to the initiation of a lunar exploration pro- 
gram. Relevant data available is summarized in Ref. 5. No corrective 
measures are postulated and no escape/rescue requirements are specified. 

RECOMMENDATIONS FOR FURTHER STUDY 

1. A study is required leading to the selection of a technique for the col- 
lection of lunar dust from the exterior of space suits and equipment 
surfaces. The collector (vacuum sweeper equivalent) should be capable 
of working in space vacuum conditions. 

2. A study is required for the design and development of improved dust 
seals for static and moving equipment components exposed to lunar dust. 

3. A study is required to determine the effects of lunar dust dispersal 
created by larger lunar landers. The effects of the dust dispersal upon 
adjacent vehicles and/or parties to be rescued is to be evaluated. 

4. A study is recommended for the development of polarizing filters for the 
attenuation of lunar surface reflected light. The filters would be 
attachable to windows or suit visors. 

5. A study should be accomplished on the use of a heliograph type device 

for beacon and communication signalling applications on the lunar surface. 

6. A specific study is required that involves the planning of early lunar 
experiments to ascertain the relative frequency of meteoroid strikes to 
the lunar surface. Further, the study must determine if the relative fre- 
quency is constant over all areas or varies with lunar latitude and longi- 
tude. 


2-236 


LMSC-A984262C 


SOURCE DATA REFERENCES 

1. "Apollo 12 - Preliminary Science Report," NASA SP-235, (MSC), NASA, • 
Wash. D.C., dated 1 June 1970. 

2. Apollo 12 Mission Report, MSC-01855, Manned Spacecraft Center, Houston, 
Texas, March 1970. 

3. Apollo Program (Phase I Lunar Exploration) Mission Definitions, MSC- 
01266, ASP0/AMP0, Manned Spacecraft Center, Houston, Texas, 1 Dec 1969. 

4. "Tracks of Lunokhod-1 Shown Before Soviets Deactivate It For Lunar Night," 
Aviation Week and Space Technology, Issue of 4 Jan 1971. 

5. "Natural Environment for the NASA Space Station Program," 2nd Ed., NASA 
TM X-53865, MSFC, Huntsville, Ala., Aug 20, 1970. 


2-237 



LMSC-A984262C 



HAZARD STUDY 32 

SUMMARY OF SAFETY GUIDELINE CONDITIONS 


1. Specifically designed atmospheric vacuum cleaners shall be installed in 
shelters, airlocks, and crew compartments to be used in final clean up 
of suits after entry and repressurization following lunar surface EVA. 

2. Lunar surface sortie parties are to be provided with foil panels (sug- 
gested as 100 ft x 3 ft and highly visible in color) which can be un- 
rolled to provide a rescue location visual marker (X). 

3. Surface sortie emergency kits shall include at least a mirror (or helio- 
graph) , flare gun and emergency radio beacon or transponder for emer- 
gency signaling purposes. 

4- Mission activity planning shall consider detailed information relative 
to topographical formations (elevation, etc.) as 
OLS data bank. Such information is vital to all 
in the avoidance of impact with lunar formations 
tions of approximately 40,000 ft. 


a necessary part of the 
landing trajectories 
which can have e leva- 
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HAZARD STUDY 33 
LEAKS IN CABIN WALLS 


INTRODUCTION 

Leaks in cabin walls can be caused by a variety of circumstances such as a 
meteoroid hit, secondary ejecta from the lunar surface, failures due to over- 
loading structural components causing cracks and punctures, degradation of 
elastomeric seals in vacuum, distortion of sealed surfaces due to heat, ex- 
plosion, collision, vibration, etc. The result in each case is loss of cabin 
atmosphere at a rate dependent on the size of the opening and the internal 
pressure. 

ASSUMPTIONS 

It is assumed that all manned cabins have a certain inherent leakage rate 
which has been accounted for in the design of the vehicle, for which make-up 
atmosphere is provided; non catastrophic leakage over the prescribed allow- 
able is what we are concerned with here. Catastrophic rapid decompression 
caused by violent rupture is not the subject of this study area. 

THE MAJOR HAZARD 

The major hazard identified is a serious loss of cabin atmosphere through 
a cabin pressure wall. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of the Hazard 


Loss of cabin atmosphere will lead to illness or death due to shortage or 
absence of breathing oxygen, unless timely corrective action is taken. 
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Corrective Measures 


Preventive measures: 

1. Provision of a leakage detection system which provides audio and visual 

warnings to the crew to enable them to quickly locate the source of the 

leak and concurrently make a rapid determination of the leakage rate. 

The latter consideration is a parameter the crew needs to know very 

quickly in order to decide whether there is sufficient time to repair 

the leak without having to don space suits. The amount of time avail- 

3 

able to the crew, for a typical space cabin of 1000 ft , can be seen in 
Fig. 1 which shows available time to decompression for 7 and 10 psia 
cabin pressures with holes varying in diameter from .10 inches to 2.0 
inches. Table 1 lists some leak detection methods suggested in Refer- 
ence a. . 

2. It is estimated that meteoroid strikes on a cabin wall producing a l/l6" 
diameter hole will be readily detectable by eye due to the local deforma- 
tion of the surrounding sheet metal structure; therefore, detection of 
the location of a strike would be made simpler and quicker if cabin walls 
are kept clear of equipment. 

3. Provide a minimum of two separate living volumes each large enough to 
accommodate the entire crew. 

4- Consider providing a self sealing wall. 

Remedial measures: 

1. Repair the damaged walls. Depending on the type and size of the damage 
a variety of repair methods have been suggested. Most of the methods in- 
volve the application of a room temperature setting, fire proof rubber 
or plastic sealant alone or in combination with plugs, patches, tapes 
applied to the pressure side of the wall. Other ideas include the use 
of self-sealing walls or self-brazing plugs. For awkward comers a 
repair patch of sheet-metal customized to fit the damaged area and with 
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Table 1 

LEAKAGE DETECTION METHODS 


METHOD 

DESCRIPTION 

P N2 decay on N 2 utilization 
(Requires location detector) 

Determine leak rate by turning off the N 2 make 
up supply & measuring partial pressure drop 

Acoustic (requires large 
numbers of detectors) 

Acoustic pick-ups located in cabin wall, to 
detect the sound of air escaping 

Ion Gauge (requires large 
numbers of detectors be- 
tween cabin wall and 
bumper) 

The ion gauge measures pressure changes in the 
cavity of a double wall structure. It can 
determine size of leak and approximate loca- 
tion 

Visual inspection (requires 
visual access) 

Use of grid lines would help identify loca- 
tion of bulge or damage 

Acoustic sniffing 

Scan cabin walls with ultrasonic detector 

Helium sniffing 

Scan walls, seals with helium jet and measure 
electrical current change in detector 

Stress coat paints 

Paint distorts in an easily observed manner 

Dyes 

Paint suspected areas to expose cracks 


sealant all around it would do the job. For larger holes l/2" or more, a 
patch should be installed with sealed blind mechanical fasteners, using a 
sealing compound between faying surfaces. (Ref. a) 

It is recommended that research be conducted to determine methods of signal- 
ing the crew that repairs are needed for walls punctured by a meteoroid. 

For example, a paint such that exposure to meteoroid shock would change its 
color would be desirable. Equally important is research to ascertain punc- 
ture repair methods that are easy to institute and which require minimal 
time to execute. 
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Escape/Rescue Requi rements 

No escape/rescue requirements are identified for repairable leaks in cabin 
walls. 

DATA SOURCE REFERENCES 

a. Repair of Leaks in an Aerospace Environment, ASD-TDR-62-1015 . 

Feb. 62. J. Withey. General Electric, Philadelphia, Pa. 
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HAZARD STUDY 33 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1. Instantaneous warning and detection/location information for cabin leaks 
above nominal shall be provided. 

2. Maximum feasible access to the cabin pressure walls, ceiling, and floor 
shall be provided in all space vehicles in order to expedite repair of 
leaks. Insofar as it does not seriously compromise equipment functions, 
all equipment should be mounted away from vehicle, spacecraft, and base 
pressure-containing walls in order to permit such access as will be 
necessary for repairs. 

3. Provide capability for supplying emergency oxygen, within seconds, to 
all crew members, in the event of excessive leaks in a space vehicle 
cabin. 

4. Kits and procedures for repairing damaged cabin walls shall be provided. 

5- It is strongly recommended that, where technically feasible, a minimum 
of two separate but interconnected pressure volumes, each capable of 
accommodating the entire crew, be provided on all space vehicles. 

6. The development of self-sealing walls should be considered. 
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HAZARD STUDY 34 

HANDLING OF HAZARDOUS MATERIALS 


INTRODUCTION 

In any exploration type program the equipments and materials required to 
obtain useful information will include a quantity of a so-called hazardous 
materials. This group of materials may range from pyrotechnics through 
explosives and from water to acids, bases, and cryogenic liquids, and may 
include quantities of elemental gases and radioisotopes (Ref. l). Simi- 
larly, the lunar exploration program will involve the use of a great many 
materials which basically may be classed as hazardous (Ref. 2). Addition- 
ally , some of the materials used and not considered hazardous on Earth may 
well prove to be hazardous when employed in the lunar environment and/or 
under zero-g' conditions. For example, in zero-g water tends to form a 
thin layer on surfaces and penetrates spaces amongst electronic equip- 
ments causing short circuits. Therefore, water floating free in a cabin 
is hazardous. 

ASSUMPTIONS 

1 . Mission exploration and science requirements include necessity 
for stores of ordnance, cryogens, chemicals, fuel, and life 
support items such as high purity cryogenic oxygen. (Ref. 2). 

2. Emergency safety equipment largely is adapted from NASA and 
USAF experience for safety equipment and procedures. (Ref. 3 
and 4). 

THE MAJOR HAZARDS 

The major hazards identified are: 

1 . Improper procedures in handling of materials or accidents in 
such materials handling. 
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2. Unsecured cargo and equipment including hazardous materials. 

ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 , Improper Handling or Accidents With Hazardous Materials 

The hazards occasioned by improper handling are applicable to all stores and 
specifically applicable to hazardous materials. 

The improper, abusive, or careless handling of such materials ranges from 
storing fuel and oxidizer materials in the same compartment to the storage 
of seismic ordnance at the end of a passage way where it can be rammed by 
cargo being moved. Improper handling also includes the failure to store 
life support materials away from hazardous chemicals, gases, and propellant 
materials in order to avoid contamination (Ref. 5), and loss by fire or 
explosion. 

The consequences of failing to understand and follow specific handling 
instructions based upon the known physical and chemical properties of 
various stores could lead to fire, explosion, emission of toxic contami- 
nants and metabolic deprivation, usually in rapid order. An event such 
as the emplacement and connection of seismic ordnance charges with suit 
transmitter energized could result in loss of a crewman. 

The hazards effects resulting from improper safeguards in the handling of 
hazardous materials are closely related to improper handling effects but 
carry the connotation of carelessness and negligence rather than inadver- 
tent oversight. The employment of safeguards is a deliberate step inserted 
into a procedure to enhance the safely of an operation, and the implied 
purpose is to establish a safety action which flags the operation as 
dangerous. Therefore, the omission of a safeguard action may be defined 
as a conscious or unconscious willful disregard for the safety of the 
specified operation. Examples of simple safeguards are signs which read 
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"do not stack" or "vent before opening." More sophisticated safeguards may 
involve the installation of a specifically designed safety valve prior to 
rupturing a safety seal to obtain access to a toxic material, or, the con- 
nection of an overboard venting device prior to refueling a satellite. 

The consequences of failure to observe safeguard requirements range from 
endangerment of the crewman and other personnel to outright catastrophe. 

Corrective Measures for Hazard 1 

Preventive Measures: 

1 . The following control measures must be implemented in planning 
for the handling of hazardous stores: 

(a) Specific container design for each type store - clearly 
marked. 

(b) Specific location in OLS, Tugs and LSB for each type of 
store material - clearly marked. 

(c) Specific handling instructions and training for all lunar 
personnel. 

(d) Specific mission activity study to ascertain optimum safe 
location for stores in each vehicle. 

(e) Establishment of mission stores check list and accounta- 
bility list for supplies control. 

2. Perform vehicle, station and base design reviews specifically to 
examine the stores storage safety features and to assess the 
hazards effects countermeasures incorporated (i.e., fire, leakage, 
explosion, vapor corrosion, contamination, etc.). 

3. Early initiation of design and development of specific stores 
containers affording maximum protection and shelf life to various 
hazardous stores. 

4- Early initiation of development of zero-g lab equipment for 
handling of toxic, corrosive and ordinary fluids without loss 
or escape of fluids and gases into closed atmosphere of orbit- 
ing stations. 
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5. Specific training of personnel in the use and purpose of all safeguard 
procedures and equipments. 

6. Incorporation of safeguard devices into design of equipment and con- . 
tainers requiring such devices. (This eliminates possibility of device 
not being used. ) 

7. Require "buddy system" in handling and use of hazardous materials to 
insure compliance with safeguard procedures and assure aid if an 
accident does occur. 

8. Require mandatory review of all hazardous material applications for 
program needs to insure: 

(a) Necessity of material use. 

(b) All hazard aspects are known. 

(c) Safeguards are more than adequate. 

(d) Procedures for use are documented and thoroughly understandable. 
Remedial Measures: 

1 . Medical equipment should be maintained in all areas of the lunar complex, 
where hazardous materials are handled, to treat injuries. 

2. Personnel of the lunar complex should be trained to treat injuries due 
to mishandled hazardous materials. Medical handbooks on such treatment 
should be readily available in the lunar complex. 

Escape/Rescue Requirements for Hazard 1 

Escape/Rescue requirements are not specific, but may range from needing 
assistance in cleaning up a leaking container to escape or rescue from a 
disaster. 

Effects of Hazard g , Improperly Secured Hazardous Material 

The hazard effects arising from unsecured or improperly secured cargo and 
equipment containing hazardous materials range from simple broken or damaged 
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outer containers to fire and explosion caused by released hazardous materi- 
als. The exposure of personnel to loose containers in zero-g can result 
in physical injury or fatality from impact and crushing. Structural damage 
from impact is also quite likely where the mass of the container is suffi- 
ciently large. 

The failure to properly stack containers or adequately secure them when 
transferring cargo on the lunar surface can result in a falling object 
injury even under the acceleration of 1/6 Earth gravity. 

Corrective Measures for Hazard 2 

Preventive Measures: 

1 . The following control measures must be implemented in the planning 
for cargo stowage involving hazardous stores. 

(a) Specific bulk cargo containers must be designed to permit 
ease of handling and securing in all stacking configu- 
rations. 

(b) Containers must provide adequate protection from shock, 
impact and vibration of hazardous contents. 

(c) Specific studies of mission activity sequences must be con- 
sidered when planning bulk cargo location and ease of avail- 
ability in the respective station, tug vehicles, and surface 
base designs. 

2. Vehicle, station and base design reviews should be performed specifically 
to examine methods of bulk stores stowage and to assess the hazards ef- 
fects countermeasures incorporated in the design. 

3. Periodic checks of bulk stowage areas should be performed to assure 
security of cargo. 

Remedial Measures 

1 . Remedial measures are the same as stated for Hazard 1 . 
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Escape/Rescue Requirements for Hazard 2 

Not applicable in this study. 

SOURCE DATA REFERENCES 

1. "Dangerous Properties of Industrial Materials" by N. Irving Sax, 
et al, 2nd Ed. 1963, Reinhold Publishing Corp., N.Y., N.Y. 

2. "Orbiting Lunar Station (OLS) - Phase A Study Final Report - 
Sec 1, Objectives and Requirements, MSC-02686, (SD-70-518) North 
American Rockwell, Space Div. , Downey, Calif., Oct. 1970. 

3. Air Force Manual 127-1, Safety, Missiles and Space Safety Hand- 
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HAZARD STUDY 34 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 


1 . Primary containers for hazardous material shall be designed to permit 
safe storage and transfer of the contained material under all conditions 
of use and storage in lunar orbit and on the lunar surface. Ascertain 
the conditions of safe stowage, handling and use of all materials con- 
sidered to be hazardous both in lunar orbit and on the lunar surface. 

2. Secondary bulk cargo storage containers shall be designed to permit 
safe transfer and handling of primary hazardous material containers 
under all conditions of transport to lunar orbit and the lunar surface. 

3. The tug vehicle, Lunar Orbiting Station and Lunar Surface Base design 
reviews shall specifically e xamin e the stores stowage safety features 
and assess the hazards effects countermeasures incorporated (i.e., fire, 
explosion, vapor control, contamination control, etc.). 

4- Considering mission activity sequences, the optimum manner of stowage for 
hazardous stores shall be ascertained, consistent with safety and avail- 
ability for use. 

5. The actual need for hazardous materials in achieving mission and program 
objectives shall be established. For each hazardous material needed, 
alternate materials shall be reviewed to ascertain the possibility of 
reducing the hazard potential by alternate selection. Alternate techni- 
ques for achieving desired program objective and eliminating the more 
hazardous materials are extremely desirable. 

6. For hazardous materials required, insure and certify (prior to flight 
approval) : 

(a) Necessity for hazardous material use. 

(b) That all hazards involved in materials use are known. 
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(c) That safeguards provided for material use are adequate 
for personnel safety. 

(d) That procedures for material use are accurately documented 
and thoroughly understandable. 

(e) That disposal of hazardous material in lunar orbit or on 
lunar surface can be safely accomplished if necessary. 

7 . Personnel shall be experienced and trained in the handling of hazardous 
materials both in zero-g and on the lunar surface. 

8. Hazardous materials shall be stored in specially designated remote area 
wherever practical. 


2-252 


LMSC-A984262C 


HAZARD STUDY 35 

HAZARDS ASSOCIATED WITH NAUSEA DURING EVA OPERATIONS 


INTRODUCTION 

A potential hazard to the space suited EVA astronaut is associated with nausea 
induced by motion effects or illness. Adverse motion effects may occur as a 
result of vehicle motions associated with lunar rovers or through accidental 
impartment of undesired motion to an EVA astronaut on a lunar orbital mission. 
Motion sickness has been of constant concern throughout the space program. 

Ever since the C-131 zero gravity or weightlessness facility was placed in op- 
eration in 1958 at the Aerospace Medical Laboratory, motion sickness has been 
a recurring problem. The Russian Cosmonaut Gherman Titov was the first to 
report motion sickness in space flight. 

ASSUMPTIONS 

For the purposes of this analysis it is assumed that nausea due to illness or 
motion within a habitable cabin environment with the astronaut in shirt- 
sleeves is a relatively minor problem to cope with. Of primary concern is the 
astronaut who is nauseated and vomits within the confines of a space suit dur- 
ing lunar traverses with a small lunar rover or during lunar orbital EVA oper- 
ations . 

THE MAJOR HAZARDS 

Vomiting in a space suit introduces the following hazards: 

1. Aspiration of expelled particles into the breathing systems. 

2. Clogging of exhaust ports of the helmet with consequent impairment of 
CO,, removal gas circulation and pressure control capability of the PLSS. 

3. Partial or total obscuration of visibility through the helmet visor. 

4. Decreased effectiveness in the performance of essential operations required 
to return the affected astronaut to a safe condition. 
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ANALYSIS OF IDENTIFIED HAZARDS 

A wide spectrum of physiogenic and psychogenic factors contribute to the motion 
sickness phenomenon. Although astronaut selection and training programs are 
designed to screen out candidates that are relatively susceptible to motion 
sickness, there is no foolproof technique for preventing or predicting nausea 
and its undesirable end effects. Even experienced aircraft flight crew per- 
sonnel have reported nausea during weightless or zero-g simulation flights. 
Further, a majority of personnel who have experienced motion sickness diffi- 
culties on such flights have indicated a willingness to participate in further 
flight tests. This brings up the concern that the over-zealous astronaut may 
similarly disregard the possibility of vomiting in the suit when he is feeling 
indisposed prior to or during EVA operations. 

Forceful and involuntary expulsion of vomitus in the suit may result in the 
following undesirable consequences in varying degrees: 

1. Vomiting is accompanied by rapid and involuntary inspiration of air through 
the mouth. This may introduce particles of varying sizes into the lungs. 

2. Suit/PLSS functions may be impaired. Clogging of the circulation system 
can affect thermal and humidity control, pressurization and CO^ and odor 
removal capability of the PLSS. 

3. Expulsion of vomitus in the space suit helmet may partially or totally ob- 
scure astronaut vision by coating the visor. 

4. Motion sickness is accompanied by a feeling of incapacitation which can be 
expected to degrade astronaut performance in effecting safety measures, 
e.g., driving lunar rover back to a lunar shelter or maneuvering an EVA 
work platform back to an orbital lunar base. 

EFFECTS OF THE HAZARDS 

The effects of nausea and vomiting during EVA operations are as follows: 
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1. Curtailment of mission and return to shelter due to impaired vision, 
general feeling of incapacitation, odors and safety hazards associated 
with aspiration of expelled food particles or clogging of suit exhaust • 
ports. 

2. Death of astronaut if breathing system is impaired by congestion with 
vomitus. 

3. Death of astronaut if C0 2 build-up is caused by clogging of exhaust ports. 
Inlet ports will remain open due to positive pressure of supply gases. 

4. Loss of astronaut cooling if the thermal control system is impaired. 

This could result in further discomfort, unconsciousness, and possibly 
death. 

5. Loss of pressure control or relief. This could cause over pressurization 
which may result in suit or PLSS rupture. This failure could further 
jeopardize astronaut safety. 

ALTERNATIVE CORRECTIVE MEASURES 

1. Continue and refine selection process of screening out astronaut candidates 
who are susceptible to motion sickness. 

2. Continue the development of drags to counter onset of motion sickness. 

3. Design lunar vehicles for a "smooth ride." 

4- Control diet of astronauts prior to EVA activities to preclude large 
particles of ingested food. 

5. Design space suits to provide collection traps to preclude depositing 
in undesirable locations. 

6. Indoctrinate astronauts relative to the hazards of nausea during EVA and 
caution against participating in EVA operations when indisposed. 

7. Incorporate secondary or redundant features to minimize the failure possi- 
bilities. For example, a redundant relief valve, located in remote or 
less vulnerable locations could back up the primary relief valve to pre- 
vent over-pressurization. 

8. Provide capability to switch to a spare or buddy PLSS if the failure occurs 
within the PLSS. 
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ESCAPE/RESCUE REQUIREMENTS 

The possibility of nausea followed by vomiting in the EVA space suit is a 
serious concern. The most effective step in coping with this problem is to 
observe the "buddy system" during both lunar orbital and lunar surface opera- 
tions. In this manner an incapacitated astronaut can most expeditiously be 
escorted to a shelter so that the space suit can be removed. 

The "buddy astronaut" could retrieve the disabled EVA astronaut in lunar orbit 
by means of a maneuvering work platform or comparable mobility/cargo trans- 
port aid. On the lunar surface, the "buddy astronaut" could drive a small 
lunar rover back to a shelter. In cases of severe distress, a lunar flying 
vehicle, if available, might be dispatched to rescue the disabled astronaut 
out on a lunar sortie. 

For cases where the EVA astronaut became disabled within walking distance of 
a shelter or MOLAB type vehicle, the "buddy astronaut" would walk the ill astro- 
naut back to the base and assist his ingress activities. 

The "buddy astronaut" can share his PLSS with the astronaut in distress if 
the failure is isolated within the PLSS, and if the distressed astronaut has 
not vomited. If the latter has occurred then it may be necessary to get past 
the face mask in order to clear the astronaut's mouth of debris. His suit may 
need clearing as well. 

The astronaut may switch to a spare PLSS. 

DATA SOURCES 

1. Symposium on Motion Sickness with Special Reference to Weightlessness, 
Technical Documentary Report No. AMRL - TDR-63-25 , June 1963. 

2. Kellog, R. S., Kennedy, R. S. and Graybiel, A. "Motion Sickness Symptomol- 
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J. Aero. Med. V. 36, No. 4, Apr 1965, pp 315-318. 
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HAZARD STUDY 35 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 


1 . Astronaut candidates must be carefully screened to el im inate personnel 
who are susceptible to motion sickness or nausea. 

2. Training and simulation programs should continue to acclimatize astronaut 
personnel to the types of extreme motions anticipated with lunar rover 
traverses or abnormal EVA motions . 

3. Lunar vehicle suspension systems should be designed for a "smooth" a 
ride as possible. 

4. The diet of astronauts prior to EVA operations should continue to preclude 
large food particles. 

5. The "buddy system," or presence of a safely man, should be practiced for 
all EVA activities. 

6. Astronauts should continue to be indoctrinated relative to the hazards of 
nausea within the confines of a space suit and enjoined to refrain from 
EVA activities when indisposed, regardless or mission priorities, unless 
required by an emergency condition. 

7. Suit design progress should evolve in the following directions: 

a. Provide increased astronaut mobility. 

b. Incorporate redundant features to preclude catastrophic failure of 
any suit/PLSS element. 

c. Include a positive collection method including a debris/vomitus trap 
or bag. 

d. Investigate the feasilility of including a backup system within the 
suit or PLSS. 

e. Provide means to open the face mask to render aid. 

f. Provide higher suit pressures to eliminate need for denitrogenization. 

g. Provide integrated suit-backpack design. 
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HAZARD STUDY 36 

RADIOLOGICAL ASPECTS OF NUCLEAR FLIGHT VEHICLE OPERATIONS 
INTRODUCTION 

The utilization of a reusable nuclear flight vehicle as the basic prime 
transport vehicle for lunar logistics shuttle service is being considered in 
two of the alternate advanced program plan study approaches currently being 
evaluated by the NASA (Ref. 1 and 2). 

The nuclear flight vehicle as currently conceived is essentially a cryogenic 
monopropellant propulsion system. Propulsive thrust is provided by a rocket 
engine, designated as the NERVA engine system, which derives its thermal 
energy from a flight-operable nuclear reactor. The cryogenic monopropellant 
fluid is liquid hydrogen stored at a low pressure in the insulated stage 
tankage. The fluid is converted to gaseous hydrogen in the NERVA engine at 
pressures and temperatures sufficient to develop the required thrust at a 
reasonably high specific impulse. 

The simple significant characteristic of the nuclear rocket engine which 
presents the greatest hazard to man and creates the largest amount of diffi- 
culty in the use of the nuclear vehicle is the intense radiation field 
associated with engine operation. Once activated the engine becomes 
intensely radioactive and remains so until the fission process has been 
shut down. Following shut-down the numerous species of fission products 
generated in the nuclear fuel decay (at various rates) causing a dropoff in 
radiation intensity with time. This process is amply described elsewhere 
in classical texts and literature (Ref. 3)* The concern of this study area 
analysis is the assessment of the radiological effects occasioned by man's 
repetitive exposure to a nuclear flight vehicle in the lunar operations 
environment. 
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Basic radiological data developed in this Hazard Study is based on radiation 
source data presented in Supplemental Data Report No. 1, presented in Appendix 
E (Ref. 4). This reference contains several figures which should be con- 
sidered a part of this Hazard Study. 

ASSUMPTIONS 

1. The nuclear vehicle considered, for purposes of this study, is a reusable 
nuclear shuttle (RNS) as generally defined and described in the Reference 
5 documentation. The RNS missions and lunar shuttle duty definitions are 
taken as given in References 2 and 6. 

2. The nuclear rocket engine considered is the NERVA engine rated at 1575 Mw 
thermal power and 75>000 pounds thrust. The nominal specific impulse is 
taken to be 825 seconds. 

3. The study assumes that an orbiting lunar station (Olfi) is operational and 
manned in a 60 nm polar orbit. It is further assumed that on-going pro- 
gram events such as surface activities, etc. are in progress. An active 
model is assumed to permit an examination of the widest spectrum of 
possible interfaces with the radiation exposure hazards. 


The normal operation of a nuclear prime transport vehicle (N-PTV) in the 
performance of its mission functions in the lunar vicinity could potentially 
result in the exposure of lunar exploration personnel to measurable and 
possibly significant radiation levels, under certain operational circum- 
stances. The operational events leading to such exposure encompass practi- 
cally the entire N-PTV operational sequence from lunar approach through 
lunar departure. Additionally, any non-nominal operations on the part of 
the N-PTV tend to enhance the potential for significant personnel radiation 
exposure. 

For analytical convenience, the N-PTV operational events considered to be 
significant hazard generators are treated in the following order: 
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1. N-PTV Lunar Orbit Insertion 

2. N-FIV Lunar Orbit Residence 

3. N-FIV Lunar Orbit Departure 
N-FIV NERVA Engine Exhaust Plume 

5 . N-FIV Off-Nominal Performance 

THE MAJOR HAZARDS 

The significant major hazards generated from nominal and non-nominal nuclear 
prime transport vehicle operation in and around the lunar vicinity may be 
stated as follows: 

1. The potential exposure of lunar exploration personnel to excessive 
amounts of nuclear radiation. 

2. The potential contamination of lunar program elements, personnel and 
exploration area with radioactive particles or debris material. 

ANALYSIS OF THE MAJOR HAZARDS 

The analysis of the major significant hazards for this study area can best 
be accomplished through a systematic examination of the interface between 
the lunar exploration personnel activities and the nuclear prime transport 
vehicle operational event sequences as it proceeds through a typical 
logistics mission. Consequently, the hazards description and hazards 
effects aspects of the analysis will be treated within each of the hazards- 
generating-N-FTV-operational-event discussions which follow. 

1. Nuclear-Fiy Lunar Orbit Insertion : 

The nuclear prime transport vehicle (N-PTV) upon lunar arrival is 
required only to inject into the reference orbit in the near vicinity 
of the orbiting lunar station (0I£>). Payload transfers to and from 
the N-FIV will be conducted by manned tug vehicles. N-PTV coplanar 
lunar arrival opportunities occur twice each lunar month although 
normal logistics trip frequency would probably not exceed one every 
5^.6 days. 
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The Radiation Source : 

For the arriving N-PTV, the most severe radiation environment will exist 
during the period in which the NERVA engine is operating, when both neutron 
and gamma radiation will be present. The intensity will depend on the 
engine/reactor power level, distance from the source, and intervening mass 
such as engine shielding or components. From Figure 1 of Ref. 4 it can be 
seen that significant dose rates may be encountered hundreds of miles away 
in the vacuum of space during periods of full power (1575 mw) operation. 

The radiation environment about the N-PTV, during engine operation may be 
inferred from data presented in Figure 2 of Ref. 4 which illustrates the 
neutron and gamma radiation dose rate to a receptor for a separation dis- 
tance of 100 ft. The sharp reduction in dose rate in the forward sector of 
the vehicle (o°-15°) is related to the nuclear engine internal shield con- 
figuration. Distance effects can be extrapolated using the inverse square 
relationship of dose to distance. 

When the engine is shut down and the source of neutrons eliminated, the 
radiation environment is considerably diminished, consisting primarily of 
gamma radiation due to fission product decay in the reactor core. Unlike 
the operating dose rate, which can be considered constant during periods of 
constant power operation, the post operational fission product source term 
is decaying with time after shutdown as well as distance and view angle. 
Figure 3 of Ref. 4 presents the fission product gamma dose rate versus dis- 
tance from the unshielded NERVA engine following shutdown in lunar orbit. 
The data are plotted for a wide range of time-after-shutdown values. 

Figure 4 of Ref. 4 presents the shut down gamma dose - time profile for a 
100 m separation distance and 90° view angle. The curve illustrates the 
dominant influence of the decaying shorter half-life fission products. The 
dose rate decreases by 3 orders of magnitude in 30 hours. 
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The LOI Exposure Hazard and Hazard Effects: 


a. Orbital Hazard and Effects 

The integrated neutron and gamma dose levels which would be received by- 
personnel at the orbiting lunar station (OIS) during the nuclear prime 
transport vehicle (N-PTV) lunar orbit insertion (LOI) has been evaluated 
in Ref. k- for two normal insertion conditions; (l) final insertion at 
10 km ahead of the OIS and (2) 10 km behind the OIS. 

During the NERVA engine LOI burn the separation distance (N-FTV to OIS) 
and view angle for both conditions are virtually the same. The total 
radiation dose delivered to the OIS during the period from startup to 
shutdown was computed to be 0.19^- mRem, of which 0. lhh mRem was attrib- 
utable to neutrons and 0.050 mRem to gamma radiation. 

Almost coincident with engine shutdown the view angle becomes less than 
15° for both conditions and remains so during most of the normal cool- 
down insertion. Thus, even though the N-PTV - OIS distance is diminish- 
ing, the protection provided by the engine internal shield effectively 
eliminates any radiation problem at the OIS. The variations in separa- 
tion distance and view angle for the case in which final LOI occurs 
10 Km behind the OIS are shown in Figure 10 of Ref. k. The view angle 
for the alternate case is also shown in the same figure. 

For N-FTV arrival 10 Km behind the OIS a total fission product gamma 
dose of 7*03 mRem, roughly 36 times the dose received during the LOI 
burn, will be received at the OIS. Most of this dose will be delivered 
during the time interval from about 38,000 to 39,000 seconds when the 
N-PTV is making a close passage with the OIS and the view angle is in 
the 60 0 to 1^0° range. 

For the alternate N-FTV arrival condition, 10 Km ahead of the OIS, the N-FTV 
would always remain oriented such that the OIS is within the engine shield 
cone, effectively eliminating any measurable dose at the OIS. 
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Thus for nominal (by-the-book) N-PTV lunar orbit insertion maneuvers 
the expected exposure of personnel in the OLS would range from 0.2 mRem 
up to 7*0 mRem for the conditions evaluated in Ref. 4. 
b. Lunar Surface Hazard and Effects 

Radiation exposure to lunar exploration personnel or installation on the 
lunar surface along the incoming trajectory trace could occur during 
periods of nuclear engine operation for the lunar arrival of the N-PTV. 

The most severe arrival situation would involve a single burn LOI maneu- 
ver in which a minimum recovery of aftercooling impulse was planned. 

This type insertion would result in the lowest altitude during the burn. 
The situation is represented pictorially in Figure 13 of Ref. 4. The 
N-PTV altitude at the beginning of steady-state operation is about 85 run. 
Neutron and gamma doses delivered to various positions along the surface 
track were evaluated using the separation distance and view angle data 
given in Ref. 4. The total neutron and gamma dose received along the 
ground track number a maximum of about 26.5 mRem at position 3 vertically 
below the N-PTV at shutdown as shown in Figure l6 of Ref. 4. For a 
normal LOI approach with engine start up at an altitude of 125 nm the 
surface dose at the reference ground track position would decrease to 
one -half or one -third of the low altitude insertion value. A further 
discussion of this exposure problem will be found in Ref. 4. 

2. Nuclear PTV Lunar Orbit Residence 


On arriving at the moon the nuclear PTV will be divested of its inbound 
payload by lunar tugs or by using propulsion units in the payload 
itself. Sometime prior to departure, an Earth-return payload will be 
delivered to the N-PTV and docked to it. At all other times, the N-PTV 
will simply stand by in orbit waiting either to receive a payload or 
x’or the desired TEI opportunity to occur. If the N-PTV is near other 
space elements, it can be commanded to maintain a rr nose-on rr attitude 
toward the particular element to preclude any dose to crews or equipment, 
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thus eliminating any accumulation of radiation dose during normal N-FTV 
standby operations. It would be parked during such standby periods 
sufficiently distant from the OIS to permit unrestricted arrivals and 
departures of lunar tugs or other vehicles. 

Except for an event involving an N-FTV system malfunction, essentially 
no hazards would normally be associated with this standby period. 

3. Nuclear FTV Lunar Orbit Departure Orbital Exposure Hazards and Effects 

The lunar orbit departure operation may be accomplished by using a single 
burn or a 3-turn maneuver, depending on the amount of plane change 
required to satisfy the trans-Earth injection (TEl) conditions. During 
the 3-turn departure the second and third burns will occur at such high 
altitudes that no effective dose will be received at the OIS. 

The neutron and gamma radiation dose received at the OIS was evaluated 
(Ref. 4) for three departure startup conditions: 

N-FTV at 10 Km Behind OIS 
N-FTV at 10 Km Ahead of OLS 
N-FTV at 20 nm Ahead of OLS 

The integrated neutron and gamma radiation dose at the OIS for the three 
conditions were found to be: 

Position at Startup Neutron Dose Gamma Dose 

10 Km behind OLS 42.9 Rem 5-4l Rem 

10 Kin ahead of OIS 2. 52 Rem . 139 Rem 

20 nm ahead of OIS . 266 Rem . 015 Rem 

The high dose for the case where startup occurs 10 Km behind the OIS 
results from the very close OIS passage (about 0.29 nm) during the 
engine operating period. 

The high neutron dose for startup behind the OIS is eliminated if the 
initial distance is increased to about 30 nm, however, a close OIS 
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passage when fission product gamma rates are near maximum is still 
required. The risk of collision during the flyby represents another 
undesirable hazard. 

The analyses (Ref. b) support the conclusion that if startup near the 
OIS was required, a position ahead of it in orbit would be favored. A 
distance of at least 20 nm would be desirable. However, since the 
N-PTV requires no direct OIE support for the TEI maneuver a more desir- 
able condition for startup would be with the N-PTV beyond the lunar 
horizon (about 680 nm for 60 nm orbit altitudes) such that the engine 
burn could not be seen at the OLS and none of the low altitude operation 
would occur near the 0I£>. 

Surface Exposure Hazards and Effects 

The most severe dose to the surface would probably occur for a single 
burn lunar departure with the N-PTV carrying maximum payload. Burn times 
of 300 to kOO sec. would be required most of which would occur at or near 
60 nm altitude. The picture would be similar to the low altitude arrival 
with the exception that altitudes and relative velocities during the full- 
power interval would be lower, suggesting higher peak doses perhaps on the 
order of 50 mRem. While the resulting conditions on the surface should 
not be considered as indicative of a major problem, they should be care- 
fully considered in planning surface activities if nuclear lunar shuttles 
are employed. 

If any event surface doses from the nominal TEI burns would normally cause 
little concern for ground positions. However, if experiments with sensi- 
tive scientific measurement instruments were involved it may be necessary 
to provide some form of protection for those systems if they are to be 
situated in locations which could be directly beneath the N-PTV during 
periods of full-power operation. 
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4. Effect of NERVA Exhaust Plume on Orbiting Lunar Elements 

During nuclear engine operation fission products can be ejected from the 
core either in particulate matter produced by corrosion of the fuel ele- 
ments or as gaseous material diffusing through the fuel matrix. Since 
these fission products will be carried along in the exhaust, they could 
theoretically represent a hazard to systems such as the OLS or Lunar Tug 
which subsequently pass through the expanded exhaust plume. 

A potential hazard to crewmen could possibly arise from a situation in 
which radioactive particulate matter were to be captured by the exterior 
surface of the OLS or other vehicle system. Subsequent EVA activities 
involving contact with the contaminated surfaces could result in a trans- 
fer of particles to the crewman's space suit or equipment and a potential 
direct skin contact or ingestion if the suit were handled after return 
to the spacecraft cabin. While a theoretical exposure route can be 
postulated, the potential for significant exposures is considered remote. 

However, the possibility of radioactive particulate matter being intro- 
duced into the OLS or Tug closed life support system is one that must be 
considered and the consequences defined. For example, a catastrophic 
failure of the N-PTV engine system, such as loss of coolant to the engine 
causing destructive disassembly of the reactor could result in hazardous 
conditions at or near the OLS or other space elements. Depending on the 
location and concentration of the radioactive debris it is conceivable 
that manned activities at the OLS might have to be restricted or even 
discontinued until sufficient dispersement of the debris had taken place. 

5. Off ..Nominal N-PTV Operations and Their Hazard Potential 

Some consideration should be given to the possibility of the N-PTV 
operating in an off-nominal manner and the impact such operations might 
have on the safety of the N-PTV or other orbiting space elements. For 
convenience off— optimum operations will be constrained to those 
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operations which result from human error or system malfunctions which 
do not result in mission abort. Three conditions were considered which 
fall into this class; (l) lunar approach guidance errors which cause' 
low altitude LOI burn and/or operation close to the OLS, ( 2 ) guidance 
errors during the pulse cooling orbit insertion which could threaten 
the OLS with collision or close passage radiation exposure and ( 3 ) reduc- 
tions in thrust at LOI which could alter bum duration and location 
relative to the OLS with final orbit insertion in other than the intended 
orbit . 

Approach Guidance Errors 

Approach asymptote errors would require an adjustment in the scheduled 
full-power engine operation at LOI and if the error was on the low 
altitude side, could result in performing the IDI bum close enough to 
the OLS to be of concern. Off-nominal approaches might be discovered 
too late to correct, but would be known far enough in advance to permit 
evaluation of the potential hazard which could result if insertion into 
the planned orbit was attempted. In the event an unacceptable hazard 
was predicted, injection into the planned orbit would be abandoned. A 
delayed LOI bum could be substituted, providing improved separation 
and view angle, injecting the N-PTV into elliptical orbit with later 
transfer to the OLS orbit. In this manner, radiation hazard to the OLS 
could be avoided although a performance penalty for the Earth-return leg 
would be encountered. 

Guidance Errors During Pulse Cooling LOI 

Guidance errors during the cooldown orbit insertion phase are probably 
the most likely area where off-nominal operations are apt to be en- 
countered. Such errors could accidently place the N-PTV in an orbit 
which could cause a collision or very close passage with the OLS. Pre- 
venting a catastrophic event of this type will require frequent updating 
of the N-PTV orbital parameters to insure prompt discovery of such a 
condition. Effect of close passage can be minimized by maintaining a 
nose-on attitude of the N-PTV during the period of concern. 
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Reductions in Thrust During LOI Burn 

Reduction in thrust may be encountered during the main lunar orbit in- 
sertion bum due to malfunctions in either stage or engine systems. If 
the situation were unanticipated (no prior warning that full thrust could 
not be achieved), insertion into the planned orbit in a single bum could 
not be accomplished. Instead the reduced thrust arrival bum would brake 
the N-PTV into elliptical orbit. Near apocenter an idle mode NERVA bum 
could be used to reduce the pericenter altitude to 60 nm and finally a 
third bum near pericenter would be required to circularize the orbit. 
Additional phasing of the N-PTV in circular orbit might be required after 
circularization unless the elliptical orbit period was carefully synchron- 
ized with the OLS (Ref 4) • 

Alternate Corrective Measures 

Preventive measures: 

a. The principal means of controlling N-PTV radiological hazard threats 
to lunar exploration crewmen will be the rigorous control of N-PTV 
spatial position in lunar orbit relative to the other operating ele- 
ments of the lunar exploration program. The nuclear vehicle oper- 
ations at and about the Moon must be so planned that N-PTV contributed 
radiation exposure to crewmen in orbit and on the surface does not 
significantly increase the radiation dose above that expected from 
natural (cosmic) radiation sources (see Hazard Study 31 )• 

Remedial measures: 

Not applicable to this study area. 

Escape/Rescue Requirements 

The escape/rescue requirements are not specifically considered in this 
study area since the subject is primarily concerned with examining 
problem areas requiring future study. However, the requirements given 
in Hazard Study 31 may be considered to apply. 
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SOURCE DATA REFERENCES 

1. "MSC Integrated Program Plan Reference Schedule - Low Budget Alternative”, 
MSC/AMPO, May 28, 1970. 

2. ”MSC Integrated Program Plan Reference Schedule - High Budget Base Line", 
MSC/AMPO, May 18, 1970. 

3. "Principles of Nuclear Reactor Engineering", S. Glasstone, Published by 
D. VanNortrand, July, 1955. 

4. "A Study to Evaluate Radiation Exposure to the Orbiting Lunar Station and 
Lunar Surface Related to Reuseable Nuclear Shuttle Operations", Supple- 
mental Data Report No. 1, Appendix E, of this report. 

5. "Nuclear Flight System Definition Study - Phase II - Final Report 
Volume II", LMSC/A968223, Sunnyvale, Calif., May 1, 1970. (NAS 8-24715) 

6. NASA - Project Description Document - Nuclear Stage, Vol. I, Project 
Definition, April 13, 1970, MSC/AMPO. 
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HAZARD STUDY 36 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 


1. Consideration of "crew radiation-exposure accountability" must be 
included in the administrative procedures devised for lunar exploration 
mission planning. It must be possible to update each crewman's exposure 
record at least once each 24 hours. 

2. Serious consideration shall be given to the implementation of a mission 
planning function which will thoroughly evaluate the "crew radiation 
exposure potential" for each phase and activity of the planned missions. 

3. Specific lunar exploration crew safety studies shall be conducted which 
explore the radiation hazards to man associated with nuclear lunar 
shuttle trajectories for LOI and TEI maneuvers. Hazard-minimizing 
trajectories and orbits shall be selected for the N-PTV which prevent 
the best trade-off of performance and safety. The studies shall be 
conducted in the context of the intended logistics missions for which 
the N-PTV is scheduled. 

4. Specific studies are required to identify and characterize the off- 
nominal performance conditions and situations which may occur in the 
employment of a nuclear prime transport vehicle in the lunar exploration 
program. The impact of the off-nominal performance situations in terms 
of radiological hazards of lunar exploration personnel is to be defined 
such that the development of suitable operational remedies is possible. 
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HAZARDS STUDY 37 
HUMAN ERROR 


INTRODUCTION 

The potential hazards engendered by the unintentional or inadvertent depart- 
ure from established plans or procedures is the subject of this study area. 
While the subject itself can be expanded to great length, this particular 
study will consider only the significant major hazards, deriving from human 
error, which have critical program implications. 

Human performance failures chargeable to human error have been an area of 
study and concern by human factors groups for many years. Basically, the 
occurrence of such performance failures, which can be classed broadly as 
human error, appear to be relatable to unawareness, fatigue and/or distrac- 
tion of attention. The classic phrase - "Pay attention to what you are 
doing" - uttered in many forms by concerned associates and mission controllers, 
is a universal reminder that human error is viewed by all as a distinct 
hazard of serious proportions. The extreme concern is warranted by more 
than ample evidence available in terms of documented consequences of error. 

The significant hazards aspects of human error occurrence in the advanced 
lunar exploration program are of great interest in planning for the safety 
of personnel likely to be engaged in exploration activity. 

ASSUMPTIONS 

1. The lunar exploration personnel complement comprises a mixture of highly 
trained astronauts (pilots and station commander) and skilled scientists 
and engineers who will receive thorough astronaut training aimed at 
providing a full capability to function effectively in the lunar eniron- 
ment (Ref. l) . Because the complement of the lunar complex will be rela- 
tively small for several years after its initiation it is expected that 
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all personnel in the complex during those early years will be trained 
fully in the handling of all abnormal or emergency situations. 

2. The critical and significant areas of concern are those operations in- 
volving the initiation, control and termination of all flight maneuvers 
and the execution of orbital or surface personnel activities where per- 
sonnel loss could result from human error. 

THE MAJOR HAZARDS 

The major hazards identified are: 

1. Judgment errors 

2. Reaction errors 


ANALYSIS OF IDENTIFIED HAZARDS 
Effects of Hazard 1. Judgment Errors 

Judgment errors perhaps constitute the most significant hazard within the 
human error classification. A basic reason for the emphasis upon computer- 
ized guidance and control stems from the fact that the decision time con- 
straints involved in high velocity maneuvers are so short that there is 
literally no time for correcting a judgment error and still achieve a correct 
maneuver. Further, there are many instances where the human senses are negated 
by external physical phenomena such as light wash-out of visual cues, or 
dust clouds generated by plume impingement which give seriously degraded 
visibility below a 50 ft altitude (Ref 2). Under such circumstances judg- 
ment errors have a high probability of occurrence. 

Typical consequences of judgment errors in lunar operations which can be 
critical or catastrophic in nature are: 
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Docking: 

Landing: 

Ascent: 

Orbital 

Operations: 


Closure velocity errors 
Angular misalignment 

Reliance on visual cues instead of instrumentation data 
Disregard of checklist sequence in prelift-off checkout and/or 
omission of critical checks. 

Disregard of approach restrictions established for: 


a. Protection of station equipment 

b. Crew protection from nuclear-PTV radiation field 

c. Crew safety at propellant depot 

d. Protection from collision in satellite orbit 


Disregard of warning instrumentation indicating: 

a. Life support problem 

b. Vehicle system operating parameter out-of-tolerance signal 
Disregard of procedures without prior approval 

Surface 

Operations: Authorizing or performing EVA without backup in a non-emergency 

situation 


Deviation from sortie plan without approval 
Disregard of prcoedures without prior approval 
Performing of unauthorized experiments 

Failure to notify associates and base of suspected hazardous 
condition or situation 


Causative factors of primary importance in the generation of judgment errors 
in otherwise nominal situations involving well trained personnel are the 
following: 
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1. Fatigue induced errors - primarily resulting from a long and somewhat 
arduous series of demanding tasks such as might be encountered on an 
extended lunar surface sortie. Fatigue build-up even in well trained 
personnel can produce degradation of mental alertness. 

2. Impaired Awareness - this condition may result from several causes in- 
cluding the excessive fatigue discussed above. Of more significance, 
however, is the fact that impaired awareness is a rapidly occurring mani- 
festation of CO^ buildup (or toxicity) . It also results from the buildup 
of other gases which poison or cause oxygen starvation in the human organ- 
ism. Thus a suited crewman, or crewmen in a small volume such as a 
cabin rover, could rather rapidly be subject to this condition if a 
failed detector system went unnoticed. 

A further aspect of impaired awareness would be "unawareness" itself. 

This could arise from a failed or malfunctioning detector system (radar, 
radiation detector, I.R. device, etc) which left the crewmen completely 
unaware of an impending or approaching hazard. 

Corrective Measures for Hazard 1 

Preventive measures: 

1. Flight operations shall require at least two crewmen at the flight station 
during all critical maneuvers such as docking, landing, ascent and orbit 
change burns. The second crewman shall monitor the checklist, monitor 
critical operating parameters, and assist the pilot in the execution of 
the maneuvers. 

2. The buddy system shall be required for all activities where a crewman 
may be jeopardized by an equipment or environment induced or self-induced 
function failure. 

3. A specific study is recommended to ascertain and define the most probable 
source of human error likely to be encountered in the operations, events, 
and activities of a lunar exploration program. The study should consider 
the define program elements involved and should consider defined mission 
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events, and activities in the logical sequential order in which they 
occur. 

4. Specific work- rest ratio studies should be conducted to ascertain (by 
simulation and activity mockup) the total fatigue buildup characteristic 
of all planned lunar surface sorties and traverses. 

5. Specific design and development effort is recommended in the region of 
toxic atmosphere detection to provide maximum assurance that the level 

of toxic contaminants in the life support equipment of any station compart- 
ment, tug crew compartment, suit, surface base or rover installation shall 
never be high enough to degrade crew awareness in their activities. 

6. All primary sensors necessary to provide awareness data to the crew 
(approach radar, radiation detectors, I.R. detectors, etc) should be 
fail-operational for two levels of failure and fail safe for the third. 

Remedial Measures: 

Potential remedial measures for judgment errors can only be defined when the 
capabilities of the vehicles or specific activitie s considered are known in 
considerable detail. At this time meaningful remedies cannot be provided. 

Escape/Rescue Requirements for Hazard 1 

Judgment errors can produce requirements for both escape and rescue, however, 
in this study area neither will be specified since the study treats the gen- 
eral hazards or group of possibilities. 

Effects of Hazard 2 . Reaction Errors 

Reaction error as a major hazard is in itself both a hazard and a hazard 
generator. Reaction error includes improper procedure, such as the inad- 
vertent or accidental activation of a system via button pushing, switching, 
or bumping as well as the accidental misreading of gauges, dials and digital 
displays. Reaction error may result from haste, conditioned reflex, tactile 
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encumberance (space suit gloves) , or even lurching of the spacecraft due to 
unplanned motions or accelerations. 

The effects of reaction errors may range from the simple nuisance of resetting 
a system to the generation of critical or even catastrophic hazards and their 
consequences. 

Typical examples of the range are: 

1. Inadvertent fuel cell feed cutoff requires reset, reactivation of feed, 
placing fuel cell "on-line", and an electrical readings check taking about 
30 minutes. 

2. Inadvertent activation of a large rover vehicle while other crewman is 
preparing to board vehicle causing personnel accident. 

3. Accidental activation of "emergency" docking latch release while hatch 
door is unsecured. (Assumes "emergency" latch release overrides normal 
hatch release interlock.) 

Corrective Measures for Hazard 2 


Preventive Measures: 

1. Human factors and engineering study of all system activation devices 
(buttons, switches, knobs and handles) should be performed to insure 
that such devices are protected, properly spaced, properly sequenced 
and interlocked, accessible, and placed according to sequential require- 
ments. Specific attention must be given to devices which must be oper- 
ated by suited crewmen in order to provide adequate hand grip and 
movement distance (Ref. 3) . Crew preference should be considered in 
this respect to the greatest extent possible consistent with design 
constraints and system operational requirements. 

2. Full size mockups of planned control stations should be provided for 
meticulous review and simulation exercises to permit evolution of final 
configurations having the least potential for reaction errors or for 
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inducing judgment errors. "The detection and elimination of potential 
sources of human error shall be an integral part of this activity." (Ref 4) 

Remedial Measures: 

Not applicable to this study for the same reasons given in Hazard 1. 

Excape/Rescue Requirements for Hazard 2 

Not applicable for same reasons as given in Hazard 1. 

SOURCE DATA REFERENCES 

1. "Lunar Mission Safety and Rescue Study, Statement of Work", Contract 
NAS 9-10969, dated June 15, 1970. 

2. "Lunar Soil Erosion and Visibility Investigations", Part 1: Summary 

Report, Task ASPO 73B, Report No. 11176-6060-R0-00 , TRW Systems, Redondo 
Beach, Calif., 13 Aug 1969- 

3. "Apollo 12 Mission Report," MSC-01855 Manned Spacecraft Center, Houston, 
Texas, March, 1970. 

4- "An Introduction to the Assurance of Human Performance in Space Systems", 
NASA Sp-6506, dated 1968. 
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HAZARD STUDY 37 

SUMMARY OF SAFETY GUIDELINE CANDIDATES 


1 . Lunar flight operations shall require two crewmen at the flight station 
during all critical flight maneuvers such as docking, landing, ascent, 
and orbit change bums. The second crewman shall function as a judgment 
error monitor and shall assist the pilot in the execution of the maneuvers 
as necessary. 

2. A "buddy-system" mode of operation, or presence of a safety man shall be 
implemented for all hazardous activities where a crewman may be jeopardized 
by an equipment or environment induced or self-induced malfunction or 
mishap. 

3. The probable sources of human error likely to be encountered in the 
expanded lunar exploration program should be identified. These sources 
should be considered in program element design refinement for safety 
enhancement. The effort should include as necessary, work-rest ratios, 
fatigue buildup, reaction error studies and such other human factors 
and engineering aspects as may be required to suppress the potential 
for human error to minimum levels. 

4* Specific efforts are recommended to enlarge upon the use of simulators 
and full scale mockup equipments for the configuration evolution of 
program element control and work stations. 


LMSC-A984262C 


HAZARD STUDY 38 
METEOROIDS 


INTRODUCTION 

Meteoroid strikes can cause damage ranging from surface abrasion to destruc- 
tion of a space vehicle, depending on particle size and velocity. A thorough 
discussion of the meteoroid flux in the vicinity of the moon and commensurate 
particle sizes and velocities is given in Ref. (a) . All three of the cited 
references deal with meteoroids from the point of view of the spacecraft 
designer and offer bases from which one can select protection against 
meteoroid penetration. 

ASSUMPTIONS 

1 . The meteoroid flux, particle size, and particle density are as stated 
in Ref. (a) in the vicinity of the moon. 

2. All other pertinent effects such as those due to shielding of the space- 
craft by the moon, the presence of various meteoroid showers as a 
function of the yearly season, etc., are also as given in Ref. (b) . 

THE MAJOR HAZARDS 

The major hazards identified are: 

1 . A meteoroid penetrates into the manned cabin of any lunar spacecraft in 
orbit or on the lunar surface leading to a vaporific flash and damage 
to subsystem hardware. In addition the crew is endangered by loss of 
oxygen by a continuing fire after the flash and by physical injury. 

2. A meteoroid penetrates the suit of an EVA astronaut in orbit, on the 
lunar surface walking or in an open rover or flyer causing loss of 
atmosphere and possible injury. 
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ANALYSIS OF IDENTIFIED HAZARDS 

Effects of Hazard 1 . Meteoroid Penetration of Pressure Cabin 

A vaporific flash is the r^r It of very rapid oxidation of a meteoroid 
which has penetrated a cabin wall. Such a flash produces flame, a tempera- 
ture and commensurate pressure increase which in turn yields damage to the 
contents of the cabin. Penetration is then followed by decompression and a 
severe temperature decrease. Pure oxygen atmospheres at an initial level 
to satisfy respiration needs for man - 3 psi - or greater - up to say, 

5.5 psi - yield much more violent reactions than an atmosphere that contains 
a diluent such as nitrogen along with oxygen. The characteristics of the 
flash depend on the kin tic energy of the meteoroid at cabin penetration, 
the cabin atmospheric constituents, and the hardware in the cabin itself 
together with the crew. Because of their very high velocities - 20 to 
30 km/sec are widely accepted averages - any meteoroid that penetrates a 
cabin wall presents a considerable danger to man and his supporting equip- 
ment. The fluxes of meteoroids have b-en well bounded for the smaller 
particles up to sizes of the order of a large grain of sand. The frequency 
of meteoroid strikes for larger particles — where the danger really lies — 
are much less well known. 

Effects of vaporific flash in manned cabins cover a spectrum from super- 
ficially burned clothing and skin to third degree burns, lung searing and 
death. 

The effects on man and his equipment will be, as discussed above, a strong 
function of the pressure and percent of oxygen in the cabin atmosphere. 

Specific injuries and damage cannot be ascertained without providing a 
reasonably accurate scenario with respect to cabin volume, numbers of crew 
members present, clothing worn, atmospheric constituents and their partial 
pressures, materials in the cabin other than the crew, and the kinetic 
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energy of the meteoroid transmitted into heat. The potential hazard is, 

however, evident and the lunar crews must be protected against meteoroid 

penetration of their cabins or EVA suits. 

Corrective Measures for Hazard 1 

% 

Preventive measures: 

1 . Meteoroid shields should be designed for all lunar spacecraft, bases, 
and vehicles that have manned cabins. Such designs should afford the 
protection required to meet acceptable risk probability criteria. 

2. The atmospheres of manned cabins should preferable consist of 2 gas 
systems, oxygen with nitrogen as the diluent in order to suppress the 
fire— damage potential in the event of a meteoroid penetration. 

3. Optics or such hardware as is critical in the support and protection of 
crew members should be protected from meteoroid damage through the use 
of iris-like shields during all times except when optics are in actual 
use. When feasible, optics shades should be provided to extend pro- 
tection during the time the optics are being used. 

Remedial measures: 

1 . Meteoroid strikes that have sufficient energy to penetrate a cabin wall 
but which do not cause a flash will, in any case, lead to depressuri- 
zation phenomena. Consequently, a kit analogous to a tire repair kit 
should be evolved to permit quick repairs to such penetrations. Repair 
methods are discussed in Hazard Study 21.5. 

2. Fire extinguishing equipment should be readily available. Such fluids 
as may be used in fire fighting equipment should be selected to have 
minimal deleterious effect on the environmental control system. 

3. Equipment containing aids to combat burn injuries should be included 
in the medical supplies aboard all spacecraft and in the LSB. All 
should be trained in the treatment of burns. 
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Effects of Hazard 2 . Meteoroid Penetration of Space Suit 

A meteoroid strike and penetration of a suited man will have effects similar 
to those described for Hazard 1 except the hazard is likely to be much more 
severe. The pure oxygen atmosphere may react violently, the small volume 
of atmosphere in a suit can be lost more rapidly than in a larger cabin, 
backup devices $re not so readily kept at hand, and a strike that penetrates 
a suit has reached the body of the occupant. 

Corrective Measures for Hazard 2 
Preventive Measures: 

1 . Practical preventive measures for meteoroid penetration of an EVA crew- 
man’s suit are not now available. Some protection can be afforded from 
the small meteoroids by designing outer garments to be penetration re- 
sistant, within practical weight limits, and by local shielding of 
critical hardware. The knowledge in Ref (a), (b), (c) should be applied 
to ascertain the safety of and need for design changes in EVA suits. 

Remedial Measures: 

1. Remedial measures will be futile for any but minor penetrations of an 
EVA crewman's suit. Where a penetration has resulted in a slow leak, 
with little or no injury to the man, temporary repair of the opening 
with a patch or donning of an emergency pressure garment may suffice 
until a safe haven can be reached or a rescue accomplished. In either 
event, use of the buddy system on EVA should reduce the hazard by pro- 
viding immediate assistance. 

Escape/Rescue Requirements 

Meteoroid punctures may generate a requiranent to escape to a backup 
pressurized compartment, second vehicle, or other safe haven. If a safe 
haven cannot be reached through escape, rescue will be required. 
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RECOMMENDATION FOR FURTHER STUDY 

There is a large uncertainty concerning the frequency of the larger sizes 
of meteoroids in the vicinity of the Moon. It is recommended that additional 
studies be initiated to decrease that uncertainty. Interest lies in sizes 
of about 1 gram and larger for both stony and nickel/iron meteoroids. 

DATA SOURCE REFERENCES 

(a) Meteoroid Environment Model - 1969 (Near Earth to Lunar Surface), (NASA 
Space Vehicle Design Criteria, Environment), NASA SP-8013, March, 1969. 

(b) Protection Against Meteoroids (NASA Space Vehicle Design Criteria, 
Structures), NASA SP-80XX, May 1970 - Preliminary - To be published as 
a NASA monograph. 

(c) Space Environment Criteria Guidelines for use in Space Vehicle Develop- 
ment (1969 Revision), D. K. Weidner, Editor, Aero-Astrodynamics Labora- 
tory, NASA TMX - 53957, October 17, 1969; NASA/MSFC. 
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HAZARD STUDY 38 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1 . Every effort shall be made to provide a two-gas atmosphere in spacecraft 
cabins, using a diluent such as nitrogen in order to suppress vaporific 
flash during meteoroid penetrations. 

2. All critical hardware directly exposed to the space environment shall 
have protection against meteoroids as required to meet acceptable risk 
probability criteria. 

3. Kits shall be devised for the quick repair of small holes in manned 
cabins caused by meteoroid punctures. 

4 . Lunar bases and spacecraft shall be designed, where feasible, to have 
two or more compartments, each capable of maintaining the cabin atmos- 
phere which supports the crew life functions. 

5. All mann ed cabins shall carry a spacesuit for each crew member aboard. 

6. All optics in hardware critical to support, protection, and survival of 
crew members shall have protective shields, such as iris-type closures, 
when not in use. 

7. The buddy system shall be used for all EVA operations. 

8. All spacecraft, lunar surface base, and other vehicles in the lunar 
complex shall carry medical equipment for the treatment of burns. All 
crew members shall be trained in the treatment of burns. 

9. Make maximum use of nonflammable materials in pressure suits and materials. 
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HAZARD STUDY 39 

CREW INGRESS/EGRESS PROBLEMS ASSOCIATED WITH DYSBARISM 
INTRODUCTION 

There axe well established hazards to the astronaut associated with rapid 
transitions from currently postulated lunar orbital base or advanced lunar 
shelter cabin atmospheres to the space suit environment. This section will 
discuss the hazards associated with dysbarism and the measures available 
for coping with this potential problem. 

ASSUMPTIONS 

This study deals with transitional effects associated with changes in 
environmental atmosphere/pressure. It is important to make certain assump- 
tions regarding the characteristics of advanced lunar vehicles, shelters, 
and orbital bases projected for the 1980-90 period. The following table 
summarizes current thinking in this regard: 


Habitable Enclosure 

Atmosphere Composition 

Pressure 

Orbiting Lunar Station (OLS) 

°2 N 2 

14.7 psi 

Advanced Large Cabin Rover 

°2 

5 psi 

Lunar Surface Base 

°2 N 2 

14.7 psi* 

Space Tug 

°2 N 2 

14.7 psi 

Current Space Suits 

°2 

3.5 psi 


* Ref. (7), Page 16 8 , suggests maximum of 7.5 psia, composition not given. 
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THE MAJOR HAZARD 

Classified and clinically significant dysbarism is a hazard that could result 
from the following astronaut ingress/egress transitions: 

OLS to EVA Space Suit 

Space Tug Lunar Shelter to Lunar EVA operations 

Lunar Surface Base to Lunar EVA 

Lunar Surface Base to Lunar Surface Rover 

ANALYSIS OF IDENTIFIED HAZARDS 

Description and Effects of Dysbarism 

Dysbarism consists of those disturbances in the body which result from the 
existence of a pressure differential in the body between the total ambient 
barometric pressure and the total pressures of dissolved and free gases 
within the body tissues, fluids and cavities. Hypobarism refers to dis- 
turbances in the body resulting from an excess of the gas pressure within 
the body fluids, tissues or cavities over the ambient gas pressure. This 
form of dysbarism might occur, for, example, when the astronaut transitions 
improperly from the Lunar Base 14.7 psi environment to the space suit 

3.5 psi pure oxygen environment. From Ref. 1, examples of Hypobaric dis- 
turbances include: 

1. Bends - deep, boring pains in the joints, bones or muscles of extrem- 
ities including the hip and shoulder caused by the evolution of gas 
from solution resulting in bubble formation. 

2. Chokes - sense of constriction or tightness in the chest or oppression 
in the chest with pain, dry cough, difficulty in breathing with a sense 
of suffocation and apprehension due probably to irritation of the pul- 
monary tissues when gas emboli cause obstruction of pulmonary arterioles 
and capillaries. 

3. Central Nervous System Symptoms - The incidence of central nervous 
system symptoms is relatively small and very variable in type and 
severity. These symptoms include one or more of the following: 
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disturbances of equilibrium and coordination, disturbances of function 
of large sensory or motor tracts, disturbances of consciousness and 
cortical function, e.g., hallucinosis, disturbances suggesting of 
increased cranial pressure, e.g., headache and painful eye movements; 
nausea; and blood pressure depression. 

4. Skin Disturbances - cutaneous discolorations, rashes, and itching. 

5. Abdominal Symptoms - "gas pains" and bloating 

Hyperbaric disturbances result from an excess of the ambient gas pressure over 
that within the body fluids, tissues and cavities. This form of dysbarism 
might occur subsequent to a transition from a space suit environment to a 
higher pressure shelter or orbital station environment. Symptoms associated 
with hyper bar ism are: 

1 . Barotalgia - ear pain caused by blockage of pharyngeal orifice of the 
eustachian tube preventing the entrance of air from the oral cavity 
into the middle ear and causing a differential pressure across the 
tympanic membrane. 

2. Barosinusitis - pain in the sinuses due to expansion of mucus membranes 
and the creation of unequal pressures in the sinus cavities. 

3. Barodontalgia - pain in the teeth ranging from dull ache to sharp and 
severe pain attributable to changes in barometric pressures. 

Individuals subject to hyperbaric disturbances may largely be eliminated 
through crew selection procedures. However, long exposure to space environ- 
ment could conceivably susceptability to these effects. 

Corrective Measures 


Problems associated with dysbarism can be avoided by taking two alternate 
courses: 

1 . All habitable elements of the lunar surface and orbital, system can be 
designed to accommodate the same pressures and atmospheres or 

2. orovide adequate transitional means to allow denit rogenat ion and 
accommodation of the astronaut to new pressure/gas environments. 
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The first approach; namely that of making all habitable system elements 
compatible, offers major problems in regard to space suit design. If the 
space suit design could be modified to allow performance of EVA at standard 
atmosphere pressure, thereby eliminating transitions from higher shelter or 
orbital station atmosphere pressures, the problems associated with dysbarism 
would largely be eliminated. Similarly, the large cabin rovers could be 
designed for a normal Earth ambient atmosphere. 

Impediments to space suit operation at higher total pressures ( 1 4- V vs. 

3.5 psi) consist of the following undesirable suit characteristics: 

a) Greater suit strength required to sustain higher pressures 

b) Higher suit leakage rates would be expected 

c) Reduced astronaut workloads would be anticipated in performing 
EVA tasks. 

While present "soft" suit concepts do not lend themselves to operation at 
greatly increased total pressures (going from 3.5 to 14.7 psi), the "hard" 
suit concept could, in all probability, be developed to accommodate these 
higher pressures and a mixed gas system. A Litton Industries progress 
report dated September 1966 states: 

The RX series of space suits is designed to accommodate normal operation at 
5 psi with either single or mixed gas atmospheres. Implications on perform- 
ance of RX suits designed for a mixed gas system are: 

1. The mobility of the suit (i.e., joint range and torque) would not 
require major redesign of any components if pressure were in the 7 

to 7.5 psi regime. A 14.7 psi arm/glove has been developed by Litton 
for the Lunar Receiving Laboratory. 

2. Weight of the suit would not materially be affected if the suit were 
operated at 7 to 7.5 psi. If the suit were made to operate at 14.7 psi 
an additional weight penalty of 20 lbs. could be expected. 

3. Life support would not be unduly complicated by the addition of an 
inert gas since the low leak rate characteristics of this suit would 
require that only oxygen make-up supply be carried in the life support 
system. 
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The second alternative approach to coping with the dysbarism problem involves 
denitrogenation of EVA personnel prior to EVA sorties. Denitrogenation 
consists of breathing increased percentages of oxygen for extensive periods 
prior to transitioning from the OgN , 14 psi to the 3.5 psi, pure 0 2 environ- 
ment. The elimination of nitrogen from the body prior to exposure to 
reduced pressures and before it can form bubbles should prevent the symptoms. 
To effect a reduction of nitrogen in the body, high concentrations of oxygen 
can be inspired for varying intervals of time. 

The rate at which nitrogen is eliminated from the body has been studied by 
a number of investigators. About one-half of the body nitrogen is contained 
in the fatty tissues of an individual whose fat content is 1 5 to 20% of his 
body weight. During decompressions of short duration, the body fat may act 
as a reservoir to protect the body ag ainst the sudden release of nitrogen 
and bubble formation. Typical nitrogen de saturation curves reveal a number 
of important facts: (l) the weight of nitrogen dissolved in the body varies 

directly with the partial pressure of N 2 in the inspired air; (2) the rate 
of nitrogen elimination in terms of volume per unit time is a direct 
function of the gradient of nitrogen tension (difference in partial pressures) 
between the outside and inside of the body . This means that if the nitrogen 
tension of the inspired air were reduced to zero, the rate of its elimination 
would be twice as fast as it would be if its tension were only reduced 50 %. 

(Ref. 1) 


There are other features of denitrogenation which are of interest. The 
measurements which have been made show that denitrogenation is most rapid 
at the beginning and then reaches a zero rate after about 6 to 8 hours; 

50% denitrogenation is accomplished in about 30 minutes. 

It is of interest that the rate of nitrogen elimination differs significantly 
between individuals and in the same individual from day to day , and that the 
subjects with a high rate of nitrogen elimination are generally more resistant 
to dysbarism than sire other subjects. 
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It has been found that approximately 4 hours of inhalation of 100$ oxygen 
is necessary to completely protect the more susceptible individuals who 
were expected to exercise at 35>000 ft (3.5 psi). One or two hours of 
oxygen inhalation offered more complete protection from bends than from 
chokes. Exercise, along with pre-mission denitrogenation might give 
accelerated elimination of nitrogen j however, this benefit could be over- 
shadowed by the disadvantage of resulting fatigue. 

Tests have shown that protection against the bends during denitrogenation is 
completely effective so long as 100$ oxygen is being used at a pressure of 
6.8 psi or greater. 

The conclusion, based on this investigation, seems to be to recommend a 
minimum denitrogenation period of 3 hours and preferably 4 hours prior to 
EVA in addition to selection of a crew relatively immune to dysbarism. 

The operational and design implications of denitrogenation or preoxygenation 
requirements are clear: 

1 . Orbital Lunar Station — The airlock should allow provisions for 2—4 
hours of uninterrupted preoxygenation prior to suit donning and EVA 
activities. This airlock must be large enough to accommodate simultan- 
eous occupancy and suit donning of all EVA personnel including a 
standby emergency rescue astronaut. 

2. Space Tug - The Space Tug must be compatible with both the orbiting 
lunar station (OLS) and lunar surface operations. When docked to the 
OLS, the tug should be at 14.7 psi 0 2 ^2 ** or transfer personnel. Whoa 
transitioning from lunar orbit to lunar surface, personnel who are to 

go EVA on the lunar surface should be denitrogenating. This denitro- 
genation can occur within the space tug environmental system can be 
designed to transition from a two gas 0^ 15 psi system to a pure 
°2 3.5 psi system. Time from lunar orbit to lunar surface will normally 
range from 3.5 to 7 hours allowing for phasing and plane changes. This 
time is sufficient to allow denitrogenation for EVA operations upon 
landing. 
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3. Lunar Shelters - operated at O^, 14.7 psi will similarly require 
airlocks which allow denitrogenation capability, and lunar activity 
schedules should provide for preoxygenation times of 2 to 4 hours 
preceding EVA. Standby rescue personnel would have to be in a pre- 
oxygenated and suited condition while other crewmen are engaged in 
EVA operations. 

4. Large Cabin Rover - If these vehicles are designed for a 5 psi, pure 
oxygen environment , transition to the suit environment offers no 
problems beyond the several minutes required for pressure equalization 
to the 3.5 psi, 0 2 suit environment. 

In addition to denitrogenation as a technique for avoiding dysbarism effects, 
other measures which should be taken are: 

1. Selection of astronaut personnel who are relatively immune or less 
susceptible to pressure transition effects. Altitude chamber exercises 
are useful in classifying personnel with regard to their susceptibility 
to dysbarism and hypoxia. 

2. Drug therapy as a means of preventing or increasing tolerance for bends 
symptoms should continue to be studied. 

3. Extensive training of astronaut candidates in the recognition of dysbar- 
ism symptoms. 

Escape /Res cue Requirements 

The first symptoms of pressure change that might appear are barotalgia, 
barosinus or abdominal bloating. These symptoms would probably appear while 
the astronaut was in the airlock preoxygenating and would prevent him from 
going EVA. 

The onset of bends, chokes and central nervous system phenomena could appear 
while the astronaut was engaged in lunar orbit or lunar surface EVA activities. 
The astronaut should be trained to recognize these symptoms of dysbarism and 
return to the shelter or orbital station, either unassisted or, depending on 
the severity of the symptoms, assisted by a "buddy" astronaut. The possibil- 
ity of dysbarism effects argues strongly for the "buddy system" for EVA opera— 
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tions since it is unlikely that both astronauts are similarly and simultan- 
eously incapacitated if normal preoxygenation precautions have been observed. 


For severe cases of bends and other dysbarism symptoms, compression therapy 
is the treatment required. Studies by the USAF School of Aerospace 
Medicine Decompression Sickness Management Team indicate that compression 
in hyperbaric treatment chamber is required. A pressure bag has been 
designed to afford relief of bends in aircraft. This bag was designed 
for combat situations where a crew member might develop severe symptoms 
during conditions where descent of the aircraft to lower attitude would 
be dangerous. The affected individual is placed in the pressure bag which 
is inflated by an air compressor. The bag is equipped with an oxygen 
regulator, headset and electrically heated suit circuit. 

Some modification of this approach for space application may be required 
for treatment of bends. It may also be possible to overpressurize the 
airlock compartment of the shelter or lunar base as a treatment technique. 
This would incur obvious weight and structural penalties to support the 
increased pressure. 
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HAZARD STUDY 39 

SUMMARY OF SAFETY GUIDELINES CANDIDATES 

1 . The "buddy" system, or presence of a safely man, should be practiced 
during . EVA activities so that an astronaut who is incapacitated from 
dysbarism effects or other illness, can be guided back to a safe 
shelter. 

2. Adequate provisions for simultaneously deni trogena ting EVA personnel 
should be provided in the OLS, the Space Tug and the Lunar Base. 

3. Crew activity schedules should allow sufficient time for adequate 
denitrogenation when a transition must be made from a higher pressure, 

2 gas cabin to lower pressure pure oxygen suit environment. 

4* Astronaut selection criteria should continue to stress relative immunity 
from the symptoms of dysbarism. 

5- Astronaut training programs should continue to indoctrinate candidates 
on the synptomology of dysbarism. 

6. Drug therapy as a means for preventing or increasing tolerance for bends 
symptoms should be investigated. 

7. Compression therapy techniques and devices, such as the pressure bag, 
should be developed for space applications to treat dysbarism symptoms. 
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Section 3 
SPECIAL TRADEOFFS 

3.1 THE LUNAR COMPLEX WITH AND WITHOUT AN ORBITING LUNAR STATION 
FUNCTIONS OF A LUNAR SPACE STATION 

The lunar space station acts as a control center for operations both in 
lunar orbit and on the lunar surface. A certain amount of scientific in- 
vestigation will be carried out aboard the station; viz., lunar mapping, 
astronomical observations. 

The station will act as control center for missions to the surface and will 
provide data to the landers as required. The station will act as a communi- 
cations relay between lunar landers, the LSB, and the Earth. 

If a separate propellant depot is established in lunar orbit it will be 
under the command of the station. The depot and all other members of the 
lunar complex will be tracked and essential parameters displayed (and acted 
upon if necessary) via telemetry. 

Besides operating an astronomical observatory in lunar orbit, all surface 
sites of interest will be photographed by the station crew as part of the 
planning for scientific investigation of such sites. Data derived from 
various lunar experiments will be processed aboard the station. 

The station would provide a safe haven for crew members rescued via a tug 
from orbit or f*om the surface. This assumes great importance if medical 
treatment is needed. 

THE LUNAR COMPLEX WITH A LUNAR SPACE STATION 

No hazards of any consequence are recognized that are due to the presence of 
h lunar space station in the lunar complex. 

THE LUNAR COMPLEX WITHOUT A LUNAR SPACE STATION 

A number of hazards are apparent if no lunar space station exists in the 
lunar complex. The hazards assume greater importance when lunar surface 
exploration is initiated since at that time only the tug exists as a haven 
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and medical aid, for example, is limited to whatever is aboard the tug. 

Other treatment then requires a return to Earth orbit. 

1 . At lunar complex initiation, neither a space station nor a lunar surface 
base are available as a safe haven in the events of injury, need for 
medical treatment, or following rescue. 

2. No orbital site will exist where a fully (propellant) loaded tug will be 
docked, constantly monitored and readily available for rescue, undetered 
by involvement in other tasks. 

3. It would be difficult to monitor a propellant depot in orbit without the 
station, and its location and status would only be known on an inter- 
mittent basis. No station crew would be available to aid in propellant 
exchange between the depot and another spacecraft. This task becomes 
more hazardous when such exchanges are instituted without the experience 
and aid of a station crew who are totally familiar with the depot. 

4* Since the proposed Integrated Program Plan (IPP) calls for non-nuclear 
powered prime transport vehicles to dock at the station when delivering 
personnel to the lunar complex, the lack of a station leaves newly 
arrived personnel to fend for themselves in getting down to the surface 
without briefings and other familiarizing aids. Moreover, there is no 
haven where they may prepare themselves for the long sortie on the lunar 
surface; therefore their stamina will be imposed upon to a considerable 
degree. 

5. Operations on the back side of the Moon would be hazardous, if not 
entirely forbidden, since only indirect communications could be con- 
ducted using an Lg libration point comsat. Initiating rescue from 
the Earth facing side of the Moon to the farside without a space 
station would be very time consuming and hence would subject the 
farside crew to whatever hazard befell them for extended intervals. 

This is certain to increase the severity of many situations; in some 
cases crew members would be lost because of the lack of quick rescue 
capability. 
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6. Optical-visual inspection of sites intended for scientific investiga- 
tion would also have to be accomplished using the tug and such activity 
for any one site would either be time limited or would require relin- 
quishing the tug from other tasks for long periods. These kinds of or- 
bital tug activity in essence add the requirement for another tug in the 
lunar complex. Alternative surface based methods of choosing sites for 
investigation would not be as accurate and thus imply the hazard of un- 
certainty about the nature of the site. This in turn would complicate 
rescue should that need arise. 

7. In the absence of a lunar orbital terminus, all deliveries of cargo and 
crew would have to be made from a prime transport vehicle (PTV) in lunar 
orbit directly to the surface. In such a case the PTV would have to bring 
a tug to lunar orbit to complete surface delivery or a tug parked on the 
surface would have to ascend to lunar orbit, dock to the PTV, transfer 
cargo and return to the surface base. Any problems or hazards encount- 
ered during orbital transfer activity would have to be resolved by the 
tug crew. No station would exist to offer any kind of aid should it be 
needed. A tug that had to abort a descent to the surface would face a 
great hazard in that no safe haven would exist after the abort. Rescue 
would have to be conducted and initiated with a tug on the surface or 
from Earth orbit. This type of procedure would increase required ascents 
and descents and thereby increase exposure to potential hazards. 

8. The lack of a space station in lunar orbit would be to the disadvantage 
of arriving PTVs, since with the station injection into lunar orbit could 
be made accurately using station beacons and other guidance aids as de- 
sired. Without the station the PTV becomes entirely dependent on its 
onboard capability. Should an arriving PTV develop any problems on ar- 
rival or should lunar injection be unsatisfactory (or fail completely), 
the hazard of crew isolation arises and rescue would face the handicap 

of being initiated from the lunar surface or Earth Orbit. Such a PTV- 
involved rescue could leave the crew and tug stranded in orbit for long 
periods. Because of the large expenditure of propellant for the rescue, 
the tug would need a source of propellant for return to the lunar sur- 
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face. Without a station, such a source would have to be on the lunar 
surface where the rescue mission is initiated. Transfer of propellant 
to the orbital tug would be complicated under such conditions. 

The advantages of having a station in lunar orbit together with obviating of 
the hazards discussed above by virtue of the presence of such a space sta- 
tion makes its existence as part of the IPP very desirable. Even in a 
worst-case consideration the station would relegate potential hazards to 
positions of considerably less concern to the crews of the lunar complex and 
to mission control on Earth. 

It is strongly recommended that the space station be made a mandatory part 
of the lunar complex and that no exploration of the surface begin until such 
time that the station is activated and manned. 
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3.2 THE LUNAR COMPLEX WITH AND WITHOUT A PROPELLANT DEPOT ON 

THE LUNAR SURFACE OR IN LUNAR ORBIT 

FUNCTIONS OF A PROPELLANT DEPOT 

Whether located on the lunar surface or in lunar orbit, a propellant depot 
would be used to supply or resupply any spacecraft with propellant to be 
used for descent to and ascent from the lunar surface, for spacecraft per- 
forming orbital maneuvers in connection with experiments or rescue, and for 
the lunar space station in its perfor man ce of station-keeping or any essen- 
tial orbital maneuvers. 

A second use of a propellant depot would be to supply oxygen for the environ- 
mental control system for any spacecraft, surface vehicle, or lunar base. 

The depot could also supply oxygen and hydrogen for fuel cells for any space- 
craft, surface vehicle or base using the cells for electrical power. 

In the event that a prime transport vehicle (PTV) used an excessive amount 
of propellant in its trip to lunar orbit, the depot could be used to re- 
supply propellant to that transport vehicle. 

The orbital depot may alternately be attached to the space station, may 
station-keep at some fixed distance from the station or may be maneuverable 
so that it can be relocated for the performance of its functions. On the 
lunar surface, the depot is most likely to be fixed with the option of mov- 
ing separate tanks via a large rover type of surface vehicle. 

POTENTIAL HAZARDS DUE TO THE PRESENCE OF A PROPELLANT DEPOT 

For a depot in lunar orbit the following potential hazards exist, although 
from a practical viewpoint the likelihood of actual occurrence of any of 
them does not appear to be very great. Nevertheless, appropriate precau- 
tions and preventive measures should be taken to obviate their occurrence. 

1. Collision between depot and another spacecraft. 

2. Explosion of a propellant tank due to a meteoroid strike. 
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3. A leak in a propellant tank places the depot on a collision 
course with the lunar space station. 

4 . An EVA astronaut on umbilical gets entangled in depot structure. 

5 . A propellant tank is mishandled when being transferred to depot, 

» escapes' to form a hazard in depot — OLS orbit. 

All of these hazards are considered in Hazard Study 13, together with the 
corrective measures suggested to anticipate and dispose of such hazards. 

The only hazard in the list above that appears in consideration of a surface 
depot is number 2. The closely related hazard of the depot being struck by 
lunar ejecta due to the engine plume of a nearby tug ascending to or descend- 
ing from lunar orbit is disposed of by proper relative locations of depot 
and tug landing pads. The hazard of propellant tank handling during arrival 
at the surface depot is discussed as hazard number 2 in Hazard Study 20. 
(Module handling leading to tip-over and injury or damage during arrival and 
location of lunar base modules) . 

Because of its fixed position, the depot can be protected against micro- 
meteoroids by constructing overhead barriers, by placement close to a crater 
rim, by construction of walls made of lunar surface material or of materials 
brought from Earth. Excavating a recess in the surface to contain some or 
all of the depot would give added protection to the depot. 

SAFETY ADVANTAGES OF A PROPELLANT DEPOT 

A depot in lunar orbit would ensure to a large degree that insofar as the 
propulsion capacity and delta velocity capability of the space tug is con- 
cerned no mission would be left undone. The capability to perform rescue 
missions is of major importance in this respect. A depot would ensure the 
availability (and therefore remove the potential hazards due to depletion) 
of oxygen and hydrogen as each may be needed for fuel cells, environmental 
control, station-keeping functions for the space station and for any other 
presently unforeseen propellant requirements. 
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POTENTIAL HAZARDS DUE TO THE ABSENCE OF A PROPELLANT DEPOT 

Not having the depot, in terms of these potential needs, presents a whole 
spectrum of potential hazards which include: 

(a) Isolation of crew members in orbit or on the surface because of 
insufficient propellant capacity for a tug. 

(b) Liability to complete or initiate a rescue because of propellant 
insufficiency. 

(c) Shortage of supplies to operate fuel cells. 

(d) In the event of a contaminated atmosphere in the space station 
or in the LSB the depot would be a source of fresh oxygen for 
replacement of the atmosphere. Nitrogen could also be stored at 
a depot for atmospheric replenishment. 

An auxiliary depot on the surface would ensure the availability of oxygen 
and hydrogen as indicated in (a) to (d) above and would particularly ensure 
propellant sufficiency for any tug that intended to ascend to lunar orbit 
from the LSB area. 

If no depot exists in orbit, then a surface depot must exist to keep landed 
tugs filled in order to pursue certain rescue missions such as a PTV failure 
to inject into lunar orbit. Otherwise, the PTV propulsion failure hazard 
might result in the loss of the crew aboard that vehicle. 

Should no depot exist either in orbit or on the surface and the requirement 
for rescue of the crew of a failed PTV still exist - as it may - then a 
surface-based tug would have to be huge in order to accomplish this mission. 
For example, choosing an average response time (see Ref. a., pg, 223 , 8 hr. 
response time) the delta velocity requirement for this mission is 24,600 fps: 
this includes 8000 fps to escape from the lunar surface, 4600 fps to chase 
the PTV, 56OO fps to return to lunar orbit, and 6300 fps to return to the 
lunar surface. In the context of the IPP the economic viability to counter 
this endangered PTV crew hazard, using so large a tug, is poor. 

The present single stage configuration stationed -*n lunar orbit could perform 
this task at much lower cost and with far less exposure to hazards j viz., the 
lunar ascent and descent. 
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In sum, the potential hazards that are obviated and the advantages gained, 
as discussed herein, lead to a strong recommendation that a propellant depot 
be stationed and maintained in lunar orbit as a fundamental part of the lunar 
complex. 

Because personnel and traffic levels are expected to increase downstream in 
time, it is also recommended that a depot be located on the surface event- 
ually. 
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3.3 TUG DESIGN EFFECTS SINGLE STAGE VS WO STAGE VS ONE AND ONE-HALF STAGE 
CONFIGURATIONS 

TUG FUNCTIONS 

The lunar tug propulsion functions consist of: 

(a) Delivery of personnel and/or cargo to the lunar surface and the 
return of personnel/cargo to lunar orbit. This function can occur 
between the lunar space station and the surface or between a prime 
transport vehicle (PTV) or another orbiting tug and the surface. 

(b) Transfer of cargo and personnel in lunar orbit to and from the PTV's 
and to and from the lunar space station. 

(c) Perform rescue missions: 

1. lunar surface to lunar surface 

2. lunar orbit to lunar orbit or beyond (e.g., past the Moon or to 
Earth) 

3. lunar orbit to lunar surface 
4- lunar surface to lunar orbit 

TUG CONFIGURATIONS 

There are presently three configurations being studied for the space tug to 
be used in the lunar complex; these include a single stage refuelable tug, a 
two- stage tug analogous to the Apollo Lunar Module, and a l£ stage tug in 
which propellant tanks are jettisoned when they are expended. 

THE SINGLE STAGE TUG 

The single stage tug has the evident potential hazard of propulsion failure 
during ascent or descent with no alternative mode or additional stage with 
which to recover. A potential method of obviating this shortcoming is to 
design the propulsion system with 4 engines located 90 degrees apart and 
operating as redundant diametrically opposed throttleable pairs. The 
engines would be operated simultaneously at of their rated thrust value 
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during tug ascent or descent missions. In the event of an engine malfunction 
its diametric twin would be turned off and the other pairs of engines would 
come up to full thrust to complete the mission. If the engines are built as 
separately replaceable units, then replacement of malfunctioned engines could 
be performed in orbit at the space station or on the surface at the LSB after 
the time it is activated. 

Some redundancy could be placed in the propellant tanks by dividing the tanks 
into 4 or 6 units (2 or 3 tanks of L0 2 and 2 or 3 tanks of LH^) and designing- 
in appropriate crossfeeds in the event of a tank or tank pressurization 
failure. 

The engine/tank redundancy, plus similar treatment for tug controls, largely 
define the preventive measures against the hazards of propulsion/control 
failures during ascent or descent procedures. 

Failures in 2 engines not diametrically opposed lead to an irrecoverable 
situation in which the crew would be lost. 

It should be observed that the suggested alternate propulsion design concepts 
for the tug would reduce the hazards of propulsion failure substantially 
during descent and that this is aided by the assumption that nonnally at 
initiation of descent the tug's propellant tanks are full. The situation 
is not the same for ascent conditions. A propulsion failure during ascent 
is critical because a large percentage of the propellant has been expended 
during descent and the remainder may be close to marginal for completion of 
ascent so that if only part of it is available (i.e., a tank failure is in- 
volved) the tank and other redundancies may be insufficient to avoid an 
ascent failure. Thus, ascent missions even with the alternate concept ad- 
vantages will still be hazardous. 

Failures in other subsystems for the single stage tug cannot be discussed 
presently because knowledge on these subsystems is not now available. It 
is expected, however, that such critical subsystems as electrical power will 
be redundant to the extent of supplying back-up electrical power during 
ascent or descent. 
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THE l£ STAGE TUG 

All of the considerations given to the single stage configuration apply to 
the 1-J- stage. However, jettisoning tanks clearly Implies the need for tank 
replacement at some later time. The handling of these tanks presents a 
hazard not found in the single stage tug to the crew whether replacement 
occurs in lunar orbit or on the lunar surface. Because of the need for tank 
jettisoning the 1-J- stage tug is, to some degree, less safe during operation 
than the single stage tug, since, if the tank jettisoning fails to take 
place the tug propulsion performance will be degraded. 

The hazards to be met in ascent with the 1-J- stage configuration are little 
different from those in the single stage tug. 

THE TWO STAGE TUG CONFIGURATION 

The hazards of stage failure in any lunar descent procedure are circumvented 
by the use of a two stage Apollo-LM type lunar lander. However, the ascent 
hazard remains since in this configuration the lower stage serves only as a 
launching platform for the ascent stage and as a consequence can play no 
part in ary ascent procedure. All of the ascent hazards to be found in one 
and in the tj- stage configurations are still present in the upper stage of 
the two stage configuration. The use of two pairs of engines/controls as 
described for the single stage configuration would essentially overcome the 
ascent hazard in the two stage lander. This still gives engine redundancy 
and does not require a separation sequence. In the event of an aborted 
descent the potential hazard of being isolated in orbit is relieved by the 
ability to perform rescue by other manned vehicles in lunar orbit. Such 
potential rescue vehicles could be docked at the space station or may con- 
stitute a manned tug in lunar orbit by itself. An ascent procedure may also 
be aborted if the velocity gain at the time of decision-to-abort is not more 
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than approximately 2000 ft/sec and propulsion and attitude control are func- 
tioning. However, some provision for landing support hardware would have to 
be included on the ascent stage for such a procedure. It is readily realized 
that this kind of ascent abort would provide hazard circumvention m only 
part of the spectrum of hazards during ascent; still, because it is a reason- 
able technique, it should not be neglected. The technique is applicable to 
all 3 configurations discussed in this section. The 2 stage and 1^- stage 
tugs introduce additional hazards by virtue of the need to replace the 
descent stage or the jetti sonable tanks. There appears to be no sharp diff- 
erences among the three configurations insofar as the presence or lack of 
hazards are concerned in the light of presently available information. 

Because of the lack of detailed information on the 3 tug configurations no 
recommendation can be made at this time depicting the least hazardous of 
these 3 concepts. 

It is strongly suggested, however, that when detailed designs of all three 
configurations are available a study in depth be conducted to ascertain the 
hazards present and the relative safety of the 3 tug configurations. 
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APPENDIX A 

LUNAR MISSION HAZARDS CHARACTERIZATION 


This Appendix assembles and presents information relative to the character- 
ization of the hazards which might be encountered in projected lunar ex- 
ploration missions. It also presents the pertinent definitions, cause and 
effect relationships and hazards groupings employed in the Lunar Mission 
Safely and Rescue Study - Hazards Analysis Task. 

1. Pertinent Definitions (Ref. l) 

Safety — Freedom from chance of injury or loss to personnel, equipment 
or property. 

Hazard -- The presence of a potential risk situation caused by an un sa fe 
act or condition, environment or natural phenomenon, personnel error, 
design characteristics, time critical normal or emergency operations, 
procedure deficiencies, or subsystem malfunction which will cause system 
or personnel loss. 

Risk ““ The chance (qualitative) of injury to personnel or loss of 
equipment, or property. 

Personnel Logp — Loss of function or injury requiring medical attention. 

Hazard Levels — Hazardous levels are identified as follows: 

Safety Catastrophic — — Condi tion(s) such that environment, personnel 
error, design characteristics, procedural deficiencies, or subsystem 
malfunction will cause system or personnel loss. 


Safety Critical — Condition(s) such that environment, personnel error, 
design characteristics, procedural deficiencies, or subsystem mal- 
function must be counteracted by urgent crew action (no time available 
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for ground/f light crew analysis) to prevent system or personnel 
loss. 

Safety Marginal — Condition(s) such that environment, personnel 
error, design characteritics, procedural deficiencies, or sub- 
system malfunction can be counteracted or controlled with time 
available for ground/flight crew analysis to prevent system 
and/or personnel loss. 

Safety Negligible — Condition(s) such that personnel error, 
design characteristics, procedural deficiencies, or subsystem 
failure will not result in system or personnel loss. 


2. Hazards Groups 


The selection of specific hazards groups considered in the study is 
based upon the recognition of a direct relationship between the cause 
of a hazard, its potential effects upon exposed crew personnel and the 
implied threat to personnel safety which the hazard may inherently 
contain (Ref. 2). It is felt that any hazards group classification 
scheme adopted must account for this relationship in order to avoid 
the purely mechanistic or system-oriented approach which neglects 
crew personnel as functioning entities. The implications of the 
cause, effect and threat relationship are apparent from an exami- 
nation of the following: 


PRIME CAUSES 
EQUIPMENT FAILURES 
ENVIRONMENTAL HAZARDS 
FUNCTIONAL INCAPACITATION 
PERSONNEL ERRORS 
PROCEDURAL ERRORS 


POTENTIAL EFFECTS 

FATALITIES 

INCAPACITATION 

DEBILITATION 

DISORIENTATION 

TRAUMA 
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BASIC THREATS 

DEPRIVATION OF METABOLIC NEEDS 
ORGANIC DAMAGE AND POISONING 
EXCESSIVE PHYSIOLOGICAL STRESS 
EXCESSIVE PSYCHOLOGICAL STRESS 


Note that the presence of a basic threat in any of the prime causes of a 
hazardous situation or condition will generate a potential risk to crew 
personnel. 

A review of the work performed by previous investigators in the determina- 
tion of logical hazards classification groupings was accomplished. The 
various groupings were compared for similarity, applicability and complete- 
ness, and then additionally checked against the cause, effect, threat 
relationship to determine specific applicability to crew personnel safety. 

The results of this effort were incorporated into a listing of hazards groups 
which appear to adequately characterize the range of hazards one might expect 
to be associated with a lunar exploration program. For the purpose of the 
current study, it was determined that a revised listing of twelve general 
classification groups were sufficient to describe the hazards most likely 
to be encountered in the hazards analysis. 


The 

hazards groups are as follows: 



1 . 

EXPLOSION/IMPLOSION 

7. 

PERSONNEL ISOLATION 

2. 

FIRE 

8. 

MOTION/ACCELERATIONS 

3. 

PRESSURE EXCURSION 

9. 

HUMAN ERROR 


COLLISION 

10. 

HOSTILE ENVIRONMENT 

5. 

CONTAMINATION 

11. 

RADIOLOGICAL HAZARDS 

6. 

INJURY/ILLNESS 

12. 

SYSTEM OR SUBSYSTEM MALFUNCTION 


A brief discussion of each hazard group is given in the interest of clarity 
of definition: 
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1. Explosion/lmplosion : - The hazards attendant to, and/or occasioned 
by sudden and violent disruption of vehicle, shelter, or contiguous 
equipment component integrity. 

Includes: Explosion or Implosion due to: State transformation 

of liquids, gases, chemicals, or ordnance sources, or induced 
transformations due to heat and/or pressure sources. 

2. Fire : - The hazards attendant to, and/or occasioned by slow or rapid 
combustion of vehicular, habitat, or suit materials capable of sus- 
tained burning once ignited. 

Includes: Liquids, gases, organic based materials, pyrophoric metals. 

3. Pressure Excursions : - The hazards occasioned by any non-violent 
decompression/over-pressure event occurring in vehicle, habitat or 
suit, outside of established pressure limits. 

Includes: Unplanned venting, pressure loss, unplanned inflation, 

unplanned deflation, etc. 

4- Collision: - The hazards occasioned by impact with natural or man- 
made objects whether originating from internal (vehicle, shelter) or 
external sources. 

Includes: Meteroid strikes, debris, unsecured equipments, other 

vehicles, lunar surface objects, etc. 

5. Contamination : - The hazards occasioned by the presence of an elemental 
or structured substance, or biological organism, whether toxic or non- 
toxic, which exceeds specified permissible concentration limits for the 
surface, fluid or media under consideration. 
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Includes: (a) 

(b) 

6. Injury/Illness ; - 
condition in which the health and well-being of the crew or a crew 
member is impaired or destroyed, due to organic damage or degradation 
or to biological invasion. 

Includes: Fractures, punctures, lacerations, concussions, metabolic 

deprivation, diseases, infection, death. (Refs. 2 and 3). 

7. Personnel Isolation: - The hazard occasioned by a condition or situ- 
ation wherein a barrier exists between a crewman and his haven of safety. 

Includes: Stranding, entrapment, communication loss, loss of 

reference position, visibility difficulties, etc. 

Motion/ Acceler ations : - The hazards occasioned by the movement of 
personnel, or of space or surface vehicles, whether planned or un- 
planned. 

Includes: Ascent, descent, braking, injection, deorbiting, linear 

motion, roll, pitch, yaw, turning, reversing, tumbling, etc. 

9* Human Errors : - The hazards occasioned by accidental or unintentional 
departure from established plans or procedures. Impaired awareness of, 
or mis judgment regarding, a situation and a course of action required. 

Includes: Inadvertent or accidental activation of systems (button 

pushing, switching, etc.)} failure to check out, enable, or arm systems} 


Substances or organisms which are inimical 
to human life or intolerable for human well- 
being. 

Substances which can impair or destroy mechani- 
cal/ electrical/ electronic equipments . 

The hazards attendant to, and/or occasioned by a 
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fatigue-induced impaired awareness regarding sequential processes or 
procedural requirements and back-up modes; incomplete assessment of 
situation or condition at hand, etc. 

10. Hostile Environment : - The hazards attendant to, and/or occasioned by- 
exposure to external environmental conditions which may be inherently 
destructive to human life. 

Includes: External temperature extremes, space vacuum conditions, 

and extraterrestrial body environments (i.e., planetary atmospheric 
gases, dust, life-forms, spores, reactive materials and liquids, 
lighting phenomena, gravity conditions, etc.) 

11. Radiological Hazards : - The hazards attendant to, and/or occasioned 
by, natural or man-made electro-magnetic and nuclear radiation sources. 

A. Natural Sources: External electromagnetic radiation, cosmic 

radiation, solar flares, and by-products of stellar nuclear 
reactions . 

Includes: Galactic cosmic rays, Van Allen belts, high and low energy 

protens, high and low energy electrons, Alpha particles, solar wind 
and flares (Refs. 4 & 5) • 

B. Man-Made Sources: Energy radiating equipments, of all types emit- 

ting penetrating rays, beams and particles. 

Includes: Radio transmitter microwave, X-ray, radar, laser-beams, 

radio-isotopic power generators, nuclear power plants, and nuclear 
propulsion systems. 
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12. System or Subsystem Malfunction ! - The hazards attendant to, and/or 
occasioned by, a system or subsystem malfunction, whether due to a 
failure to perform, or to performance degradation. 

Includes: Any system, subsystem, or equipment item (hardware/software), 

the functional capability of which is critical to the execution of a 
local or remote operation or activity. 

REFERENCES 

1. MSCM-1701, "System Safety Program Requirements for Space Flight Contrac- 
tors." NASA/MSC - Houston, Texas (not dated). 

2. RM-5200-NASA, "Contingency Planning for Space Flight Emergencies," 

(Dole, et al.), Rand Corporation, January 1967. 

3. "Summary of Medical Experience in Apollo 7 through 11 Manned Space 
Flights," C. A. Berry, NASA/MSC, Aerospace Medicine, May 1970. 

4* "Radiological Concepts for Manned Space Missions," J. Pickering, 

Aerospace Medicine, February 1970. 

"Operational Safety of Nuclear Rockets," F. X. Gavigan, USAEC/SNPO-W, 
December 1969. 
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APPENDIX B 
LUNAR MISSION MODEL 


An advanced lunar exploration program proposed for the 1980 to 1990 time 
period must be fluid and open to change during the next several years. Equip- 
ment designs, operational interfaces, operational safety, exploration objec- 
tives, national priorities, and budgets will be among the factors contin ual ly 
traded off in working toward a firm, approved program. In the meantime, 
safety requirements must be developed in order that the equipment elements 
may be designed and exploration programs planned to provide the lunar ex- 
plorers of the future with a safe operation. 

The development of safety guidelines or requirements must proceed from knowl- 
edge of the hardware elements to be used and the operations and schedules to 
be supported. It is evident that this development process must be iterative. 
For the Lunar Mission Safety and Rescue Study it was necessary that a model 
program, with alternates, be chosen to expose the potential hazards to man. 

The baseline model provided by NASA was the Integrated Program Plan (IPP) 
Reference Schedule - High Budget Baseline dated 5-18-70 (Ref. 1), with the 
addition of alternate nuclear or chemical shuttles between Earth orbit and 
lunar orbit. The IPP Reference Schedule - Low Budget Alternative dated 
5-27-70 (Ref. 2) was provided as a representative alternate program. 

With the Integrated Program Plan (IPP) high budget model as a baseline, 
representative lunar mission operations were defined for use in the study. 
Equipment and operations data from current and past studies and actual Apollo 
missions were freely consulted in order to make the model as realistic as 
possible. Representative hardware elements and use descriptions were ob- 
tained from the NASA-MSC Project Description Documents (PDD's) for Space Tug, 
Nuclear Stage, Chemical Stage, Lunar Orbit Station, Fuel Depot, Lunar Surface 
Base, and Surface Transportation, References 3 through 9, respectively. The 
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mission model was summarized by NASA in Ref. 10. 

As an analysis aid, Lockheed developed operations time-lines for the mission 
model. The basic traffic model is presented in Ref. 1. The lunar mission 
functional flow diagrams are presented in Appendix D of this report, MSC- 
03977. 

The major items of spacecraft, lunar surface vehicles, surf ace installations, 
and other equipments that were considered to be a part of the lunar complex 
and were derived from the constituents of the high level IPP and associated 
PDD's include but are not limited to: 

1. A space tug consisting of propulsion module, 6-man crew module, 
an intelligence module, a cargo module, and landing gear. 

2. A Prime Transport Vehicle (PTV) which may have a chemical or nuclear 
propulsion system. The PTV transports men and cargo between Earth 
orbit and lunar orbit. 

3. A 12-man space station in lunar orbit, together with auxiliary 
modules for purposes of conducting experiments and for supporting 
other space station activities. 

4. A propellant depot in lunar orbit which may be attached to the 
space station or free flying but under the jurisdiction of the 
space station. At a date downstream in the lunar program, a supple- 
mentary depot may be established on the lunar surface. 

5. Lunar surface cabin and non-cabin type roving vehicles. 

6. Lunar flying vehicles which may be equipped to carry a pilot and 
a passenger. 

7. A 6-man to 9-man Lunar Surface Base which is a multi-compartmented, 
multi-decked permanent installation on the lunar surface intended 
to support far-ranging surface exploration. 
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8. Lunar Shelters which may be brought to any site at which lunar 
activities will be conducted. They are considered temporary and 
movable structures. 

9. Lunar scientific equipment which covers all and any equipment 
brought to the surface or to lunar orbit to directly aid in the 
spectrum of experiments to be conducted in the lunar complex. 

10. Lunar Surface Support Equipment to be used in supporting all crew 
member activities including basic functions such as power for life 
support and extended functions such as the surface experiments. 

A nuclear based electrical power system is expected to be included 
when the LSB becomes an operating entity. 

11. Unmanned lunar satellites supporting basic functions such as com- 
munications and other satellites used in the realm of scientific 
experiments . 

It is emphasized that the models were used only as a necessary analysis aid 
and point of departure for a broad safety and rescue study. Every effort was 
made throughout the study to keep in mind that the objective was to develop 
safety guidelines and rescue concepts in a general sense in order to influence 
the design of new equipment and the planned operation of that equipment. 
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References : 
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2. NASA-MSC Integrated Program Plan Reference Schedule, Low Budget Alterna- 
tive - May 28, 1970. 
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9. NASA-MSC Project Description Document - Lunar Surface Base - June 15, 1970. 

10. Contract NAS 9-10969 Statement of Work, Appendix A, Description of Lunar 
Program Portion of Manned Spaceflight Integrated Plan - April 1, 1970, 
NASA-MSC . 


B-4 


LMSC-A981)-262C 


APPENDIX C 

HAZARD ANALYSIS METHODOLOGY 


The hazards analysis proceeded from the task objectives and the mission 
model defined for the study as shown in Figure C-l. 

The first step was to describe, in a top level flow diagram, the functions 
and operations of the lunar exploration elements making up the model. This 
top level functional flow diagram, presented in Appendix D, displays and 
links the major items of lunar exploration equipment and the major opera- 
tions that take place with that equipment. 

The top level flow diagram is then' expanded in a series of first level flow 
charts to display mission events and identify potentially hazardous condi- 
tions and situations requiring study. The complete first level hazards 
assessment is presented in Appendix D and identifies hazard generators, 
hazards, potential hazard effects, applicable hazard groups, and the hazard 
level range. 

Each event in the first level hazards assessment was examined, and a list 
of hazardous conditions and situations requiring further study was compiled. 
This list was then expanded to include special situations and conditions, 
such as lighting, communications, and lunar environment, not stated in the 
lunar mission program model of sequence of events. Each item on this list 
was subjected to an individual study to identify the hazards in greater 
detail, describe the hazards effects, propose alternate preventive and 
remedial measures, note requirements for escape and rescue, and present 
candidate safety guidelines and requirements. Section 2 of this report 
presents the complete results of the individual studies. 

The first step in each Hazard Study was to state the assumptions important 
to the situation to be analyzed. Next, the major hazards were listed and 
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Fig. C-l Hazard Analysis Methodology 
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described briefly. Each hazard was then analyzed to determine the effects on 
crew safety, and to perform trade studies of alternate corrective measures, 
both preventive and remedial. For each hazard, the possible need for es- 
cape and/or rescue was noted. The final step was preparation of a list of 
candidate safety guidelines and requirements. The completed Hazard Study 
was then passed on to the Escape/Rescue subtask team where the requirements 
were defined in greater detail and escape/rescue concepts and guidelines 
proposed. 

With the individual studies complete, a study of the hazards identified 
and of the guidelines candidates was made to assess compatibility and feas- 
ibility and to firm up the recommendations presented in Section 2 of MSC“ 
03976. 
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APPENDIX D 

FIRST IEVEL HAZARDS ASSESSMENT 

This appendix presents the first level hazards assessment described in 
Appendix C. 

The top level functional flow, Fig. D-l, displays and links the major items 
of lunar exploration equipment and the major operations that take place 
with that equipment. 

The top level flow diagram is expanded in a series of first level flow 
charts to display mission events and identify potentially hazardous con- 
ditions and situations that might occur in a typical advanced lunar pro- 
gram. For each event in the mission, the hazards generators, hazards, 
hazards groups, and hazard level range are identified. 



PROPELLANT _ |— ► PERFORM ORBIT KEEPING (SELF) 

DEPOT (FD) REFUEL TUG 
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Fig. D-l Top-Level Functional Flow - Lunar Mission Operations 
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Fig. D-2 Model Top-Level Definition 
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Fig. D-3 Logistics Operations First-Level Functions 
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Fig. D-4 Logistic Operation - 1.1: Prime Transport Vehicle Delivery 

of Orbiting Lunar Station (PTV/OLS) 





(1st MANNED MISSION) C - PTV = CHEMICA L ALTERNATE STAGE 
N-PTV = NUCLEAR STAGE 

MPL = MANNED PAYLOAD (CREW-1, CREW CAPSULE-1, SPACE TUG, LANDER TUG) 
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Fig. D-5 Logistic Operation - 1.2: Prime Transport Vehicle Delivery 

of Crew-1 and Tug Vehicles (PTV/MPL) 





(SUBSEQUENT MANNED MISSIONS) PTV: CHEMICAL OR NUCLEAR SHUTTLE VEHICLES 

MPL: ANY PAYLOAD CONTAINING CREW PERSONNEL 
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Fig. D-6 Logistic Operation - 1.3: Prime Transport Vehicle Delivery of 

Replacement Crew and Supplies (PTV/MPL) 




GENERALIZED CASE FOR UNMANNED LOGISTICS MISSIONS 
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Fig. D-8 Orbital Operations First-Level Functions 
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PTV: PRIME TRANSPORT VEHICLE (CHEMICAL OR NUCLEAR SHUTTLE) 

LPL: LOGISTICS PAYLOAD (CARGO CONTAINER, SCIENCE CANISTER, FUEL DEPOT CANISTER) (TYPICAL STACKED PAYLOAD) 
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I ASSY & LPL DOCKING ASSY ) 
v (OR LPL ) MAY REQUIRE j 
\ EVA TRANSFER J 
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HAZARD GROUPS: 

1. EXPLOSION/IMPLOSION 

2. FIRE 

3. PRESSURE EXCURSION 

4. COLLISION 


5. CONTAMINATION 

6. INJURY/ILLNESS 

7. PERSONNEL ISOLATION 

8. MOTION/ ACCELERATIONS 


9. HUMAN ERRORS 

10. HOSTILE ENVIRONMENT 

11. RADIOLOGICAL HAZARDS 
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A. SAFETY CATASTROPHIC 

B. SAFETY CRITICAL 

C. SAFETY MARGINAL 

D. SAFETY NEGLIGIBLE 
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Fig. D-10 


Orbital Operations 2.2: Tug 
Orbital Operations (Typical) 
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PTV: PRIME TRANSPORT VEHICLE (CHEMICAL OR NUCLEAR SHUTTLE) 

LPL: LOGISTICS PAYLOAD (CARGO CONTAINER, SCIENCE CANISTER, FUEL DEPOT CANISTER) 
FD: FUEL DEPOT 


NOTE: 

G&C: GUIDANCE & CONTROL 
P. M. : PROPULSION MODULE 
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HAZARD GROUPS; 

1. EXPLOSION/IMPLOSION 5. 

2. FIRE 6. 

3. PRESSURE EXCURSIONS 7. 

4. COLLISION 8. 
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D. SAFETY NEGL 


1TROPHIC 
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Fig. D-10 (Continued) 


D-12 




LMSC-A984262C 


OLS : ORBITING LUNAR STATION 

TUG : LANDER TUG WITH CREW CAPSULE AND CARGO CAPABILITY 
PDPS: POWERED DESCENT PHASE SEQUENCE 
ALPS: APPROACH AND LANDING PHASE SEQUENCE 


(NOTE: 2.3 HAS TWO SHEETS) 
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REORIENT TUG 


1^ 

I 

I 


1. DOCKING ERRORS 

• VELOCITY 

• ANGLE 

• DISTANCE 

2. REFUELING 
ACCIDENT 

I 





POTENTIAL DAMAGE 
OR LOSS OF TUG, 
CREW AND/OR DEPOT 
LOSS OF FUEL/TUG 
/DEPOT OR ALL 
THREE 




POTENTIAL ^ 
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1 . EXPLOSION/IMPLOSION 

2. FIRE 

3. PRESSURE EXCURSIONS 

4. COLLISION 
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SECURE TUG. 
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5. CONTAMINATION 

6. INJURY/ILLNESS 

7. PERSONNEL ISOLATION 

8. MOTION/ ACCELERATIONS 


9. HUMAN ERRORS 

10. HOSTILE ENVIRONMENT 

11. RADIOLOGICAL HAZARDS 

12. SYSTEM OR SUBSYSTEM MALFUNCTION 


HAZARD LEVELS: 

A. 'SAFETY CATASTROPHIC 

B. I SAFETY CRITICAL 

C. SAFETY MARGINAL 

D. SAFETY NEGLIGIBLE 


Fig, D-ll Orbital Operation - 2,3: 
Tug Surface Descent 
Operations ( Typical ) 
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OLS : ORBITING LUNAR STATION 

TUG: LANDER TUG WITH CREW CAPSULE AND CARGO CAPABILITY 
N&G: NAVIGATION AND GUIDANCE 


REF. -3.0 
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2.3.11 

2.3.12 

LOAD TUG; CHECK- 
OUT AND ACTIVATE 
SYSTEMS; UPDATE 


BOOST TO 15 KM 
rVR "RTT 


COAST AND INITIATE 
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5. CONTAMINATION 

6. INJURY/ILLNESS 
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8. MOTION/ACCELERATIONS 


9. HUMAN ERRORS 
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B. SAFETY CRITICAL 
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D. SAFETY NEGLIGIBLE 


Fig. D-ll (Continued) 
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Fig. D-12 Lunar Surface Operations First-Level Functions 
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MAJOR ELEMENTS • LUNAR LANDER TUG 
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fig, D-13 Surface Operations - 3.1: 
Tug Missions - a* 30 Days 
Staytime 
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MAJOR ELEMENTS 
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MAJOR ELEMENTS 
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MAJOR ELEMENTS • LUNAR LANDER TUG OR LUNAR SURFACE BASE (LSB) 
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Fig. D-17 Lunar Surface Base Operations First-Level Functions 
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SUPPLEMENTAL DATA REPORT NO. 1 

A STUDY TO EVALUATE RADIATION EXPOSURE OF THE 
ORBITING LUNAR STATION AND THE LUNAR SURFACE 
RELATED TO REUSABLE NUCLEAR SHUTTLE OPERATIONS 

1. STUDY OBJECTIVES AND APPROACH 

This study was conducted to determine the radiation environment created by a 
Reusable Nuclear Shuttle (RNS) in performing its normal mission functions 
while in the lunar vicinity, and to evaluate the impact of that environment on 
the Orbiting Lunar Station (OLS) or lunar surface operations. Trajectory data 
and the nuclear engine (NERVA) operating history were taken from data developed 
during the Nuclear Flight Systems Definition Study, Phase II (NAS 8-24715) 
and reported in Ref. 1. Although operating characteristics of the NERVA 
engine have recently been revised in regards to startup, shutdown, and cool- 
down, the changes will have only secondary effects on trajectory behavior and 
little or no effect on the radiation environment. 

The OLS is assumed to be in 60 n.mi. circular polar orbit. The RNS on lunar 
arrival will be required only to inject into the reference orbit in the near 
vicinity of the OLS. All payload transfers to and from the RNS will be con- 
ducted by other space elements (tugs, etc.). Residence time of the RNS in 
lunar orbit can vary from about 4 days to 30 days during which time no oper- 
ation of the NERVA engine will occur. RNS coplan ar lunar arrival opportuni- 
ties occur twice each lunar month although normal trip frequency would prob- 
ably not exceed one every 54*6 days. 

Most lunar departures will require some out-of-plane maneuvers in order to 
permit coplanar arrival at Earth. These departures will normally be performed 
using a 3-bum maneuver to minimize energy requirements, although single bum 
departures may be selected if the total plane change requirement is less than 
20 degrees. 
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2. RADIATION ENVIRONMENT CREATED BY THE NUCLEAR ENGINE 

2.1 OPERATIONAL ENVIRONMENT 

The most severe radiation environment will exist during periods in which the 
NERVA reactor is operating when both neutron and gamma radiation will be 
present. The intensity will depend on the reactor power level, distance from 
the source, and intervening mass such as engine shielding or components. 

From Figure 1 it can be seen that significant dose rates will be encountered 
hundreds of miles away in the vacuum of space during periods of full power 
(1575 mw) operation. 

The effect of shielding and scatter from engine and stage hardware on the 
neutron and gamma dose rates is presented in Figure 2 for a separation dis- 
tance of 100 feet. For this evaluation the 1969 CRAM (Common Radiation Analy- 
sis Model) as given in Ref. 2 was used. The sharp reduction in dose rate in 
the forward sector of the vehicle (0° - 15°) is related to the engine internal 
shield. Neutron dose rates assumed an RBE (radiobiological equivalent) fac- 
tor of 8. Distance effects can be determined using the inverse square rela- 
tionship of dose to distance. 

2.2 POST OPERATIONAL ENVIRONMENT 

When the reactor is shut down and the source of neutrons eliminated, the radi- 
ation environment will be considerably diminished, consisting primarily of 
gamma radiation due to fission product decay in the core. Unlike the oper- 
ating dose rate, which can be considered constant during periods of constant 
power operation, the post operational fission product source term is decay- 
ing with time with the result that the environment is a function of time after 
shutdown as well as distance and view angle. In Figure 3 it can be seen that 
1 hour after shutdown the fission product gamma dose rate at 5000 meters 
(2.7 nm) is 4 x 10~ R/sec (0.144 R/hr) , while for the operating engine (see 
Figure l) the same dose rate from combined neutron and gamma radiation could 
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be received as far away as 150 n.mi. Furthermore, because the fission product 
source is diminishing with time (see Figure 4) one would have to remain about 
4200 meters from the engine for 1 hour to receive 0.144 Rem (see Figure 5) . 

For the first few days following shutdown the fission product source term 
will be dominated by the short-lived fission products from the last bum. For 
longer decay times the buildup of greater inventories of longer-lived fission 
products related to multiple bums will become more pronounced as can be seen 
in Figure 5 for the first and second arrival of the RNS in lunar orbit. 

For the analyses the post operational fission product source term was computed 
following shutdown in lunar orbit for the first lunar mission of the RNS and 
is shown in Figure 4* These data are representative of the 90° view angle, 
or maximum dose rate considering only the self-shielding effects of the core 
itself. Attenuation due to view angle used in the study, again based on 
Reference (2), is shown in Figure 6. As was done for the operating case, dis- 
tance attenuation was computed using the inverse square relationship. 

3. EFFECT OF DECAY HEAT ON RNS PROPULSIVE MANEUVERS 

In addition to the radiation environment caused by the decaying fission pro- 
ducts in the engine core, a considerable quantity of heat is released which 
must be removed to prevent damage to the engine. For example, at the end of 
shutdown (Scram) for a typical L0I bum the decay heat rate is about 3.7 x 
10'^ Btu/sec which would be sufficient to vaporize core material if a contin- 
uous flow of coolant was not provided. After about 325 seconds the rate will 

Q 

have dropped to about 6.8 x 1(T Btu/sec and the cooling can be provided at a 
lower rate, or as is the case, in intermittent pulses. These pulses will con- 
tinue with diminishing frequency until the decay heat rate is low enough to 
permit cooling by radiation alone. Current data using 5 Btu/sec as the cut- 
off would require active cooling for approximately 40 hours following the 
L0I bum. 


E~3 


LMSC-A984262C 


The effect of this cooling requirement on the trajectory at lunar orbit 

arrival is shown in Figure 7 in which the inpulse produced by the after cool- 

ing is used to provide a portion of the AV required for the orbit insertion. 
While the long pulse-cooling time (in the example only about 12 hours of cool- 
down impulse were used) will complicate the maneuver from a guidance and con- 
trol standpoint, it has the advantage of increasing the separation distance 
between RNS and OLS during the actual reactor operation. 

A typical three bum departure maneuver is shown in Figure 8. For this man- 
euver only the first bum will occur close enough to the OLS or lunar surface 
to be of concern. 

4. RADIATION EXPOSURE TO THE OLS DURING NORMAL RNS LUNAR MISSION OPERATIONS 
4.1 LUNAR ORBIT INSERTION 

The integrated neutron and gamma dose levels which would be received at the 

OLS during RNS lunar orbit insertion were evaluated for two conditions; (l) 

final LOI 10 Km ahead of the OLS, and (2) 10 Km behind the OLS. 

During the main engine bum the separation distance (RNS to OLS) and view 
angle for both cases are virtually the same and are presented in Figure 9- 
The total dose delivered to the OLS during the period from startup to scram 
was computed to be 0.194 mRem, of which 0.144 mRem was attributable to neu- 
trons and 0.050 mRem to gamma radiation. 

Almost coincident with shutdown the view angle becomes less than 15° for both 
cases and remains so during most of the cooldown insertion. Thus, even 
though the RNS - OLS distance is diminishing, the protection provided by 
the engine internal shield effectively eliminates any radiation problem at 
the OLS. The variations in separation distance and view angle for the case 
in which final LOI occurs 10 Km behind the OLS, and the view angle for the 
alternate case, are shown in Figure 10. 
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For arrival 10 Km behind the OLS a total fission product gamma dose of 7.03 
mRem, roughly 36 times the dose received during the main bum, will be re- 
ceived at the OLS. Most of this dose will be delivered during the time in- 
terval from about 38,000 to 39,000 seconds when the RNS is making a close 
passage with the OLS and the view angle is in the 60° to 140° range. 

For the alternate arrival condition, 10 Km ahead of the OLS, the RNS would 
always remain oriented such that the OLS is within the engine shield cone, 
effectively eliminating any measurable dose at the OLS. This case also elim- 
inated the close passage problem encountered in the other example. 

Increasing the separation distance at final L0I would have little effect on 
the dose if arrival behind the OLS is selected unless the distance was in- 
creased to the point that the close passage was eliminated. It can reason- 
ably be concluded then that unless mission conditions dictate otherwise, ar- 
rival of the RNS ahead of the OLS would be selected. 

4.2 LUNAR ORBIT DEPARTURE 

The lunar orbit departure operation may be accomplished using a single bum 
or a 3-bum maneuver, depending on the amount of plane change required to 
satisfy the trans-earth injection (TEl) conditions. During the 3-bum de- 
parture the second and third bums will occur at such high altitudes (see 
Figure 8) that no effective dose will be received at the OLS. 

The neutron and gamma dose received at the OLS was evaluated for three de- 
parture startup conditions; RNS 5.4 n.mi. behind the OLS, RNS 5-4 n.mi. 
ahead of the OLS and RNS 20 n.mi. ahead of the OLS. 

Separation distances and view angles for startup 5*4 n.mi. (10 Kin) ahead of 
and 5.4 n.mi. behind the OLS are presented in Figures 11 and 12. Startup 
20 n.mi. ahead would be similar to the 5.4 n.mi. ahead case except that the 
distances would be greater by about 15 n.mi. 
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Integrated neutron and gamma doses at the OLS for these cases will be: 


Position at Startup Neutron Dose 


5.4 n.mi. behind OLS 
5.4 n.mi. ahead of OLS 
20 n.mi. ahead of OLS 


42 . 9 Rem 
2.52 Rem 
.266 Rem 


Gamma Dose 

5.41 Rem 
.139 Rem 
.015 Rem 


The high dose for the case where startup occurs 10 Km behind the OLS results 
from the very close OLS passage (about 0.29 n.mi.) during the reactor opera- 
ting period. The benefits of even modest increases in separation distance 
are readily apparent from the other two cases evaluated. 

The high neutron and gamma doses during engine operation for startup behind 
the OLS could be eliminated if the initial distance was increased to about 
30 n.mi., however, a close OLS passage when fission product g amma rates are 
near n)*nri imim would still be required. Additionally, the risk of collision 
during the flyby would also represent an undesirable hazard. 

The analyses support the conclusion that if startup near the OLS was required, 
a position ahead of it in orbit would be favored. A distance of at least 
20 n.mi. would be desirable. On the other hand, since the RNS requires no 
direct OLS support for the TEI maneuver a more desirable condition for startup 
would be with the RNS beyond the lunar horizon (about 680 n.mi. for 60 n.mi. 
orbit altitudes) such that the engine burn could not be seen at the OLS and 
none of the low altitude operation would occur near the OLS. 

4.3 RADIATION EXPOSURE DURING RNS RESIDENCE IN LUNAR ORBIT 

On arriving at the Mcon the nuclear shuttle will be divested of its outbound 
payload by lunar tugs or using propulsion units in the payload itself. Some- 
time prior to departure an Earth-return payload will be delivered to the RNS 
and docked to it. At all other times, the RNS will simply stand by in or- 
bit waiting either to receive a payload or for the desired TEI opportunity 
to occur. If the RNS is near other space elements, it .can be commanded to 
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maintain a "nose-on" attitude toward the particular element to preclude any 
dose to crews or equipment, thus eliminating any accumulation of radiation 
dose during normal RNS standby operations. It would be parked during such 
standby periods sufficiently distant from the OLS to permit unrestricted 
arrivals and departures of lunar tugs or other vehicles. 

Except in the event of an RNS system malfunction no hazards would be associ- 
ated with this standby period. 

5. RADIATION EXPOSURE TO LUNAR SURFACE DURING RNS ARRIVAL OR DEPARTURE 

Radiation exposure to men or installations on the lunar surface along the 
incoming trajectory trace could occur during periods of nuclear engine oper- 
ation for the lunar arrival and departure bums. The most severe arrival 
situation would involve a single bum LOI maneuver in which a minimum re- 
covery of after-cooling impulse was planned.. This type insertion would re- 
sult in the lowest altitude during the bum. For evaluation, an incoming 
trajectory was selected for which no after-cooling impulse recovery was 
employed. The approach is represented pictorially in Figure 13. RNS alti- 
tude at the beginning of steady-state operation is about 85 n.mi. Neutron 
and gamma doses delivered to various positions along the surface track were 
evaluated using the separation distance and view angle data given in Figures 
14 and 15. 

The neutron and gamma doses received along the ground track reach nwti munis 
of about 23.5 and 3.0 mRem at position 3, vertically below the RNS at shut- 
down (see Figure 16) . Uprange positions 1 and 2 benefit from the change in 
view angle after the overflight while downrange positions 4 and 5 benefit 
from increased range and even more important are hidden by the lunar horizon 
during the early portion of the bum with position 5 not coming into view 
until shutdown is initiated. 
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Normal LOI bums would start up at altitudes of about 125 n.mi. and shut down 
at about 95 n.mi. for which case the dose at the surface would be reduced to 
perhaps one-third to one-half the values for the low altitude approach. In 
any event surface doses from the LOI or TEI bums would cause no concern for 
ground positions unless experiments with sensitive measurement instruments 
were involved in which case it may be necessary to provide some form of pro- 
tection for these systems if they are situated in locations which could be 
beneath the RNS during periods of full-power operation. 

The most severe dose to the surface would probably occur for a single burn 
lunar departure with the RNS carrying maximum payload. This case was not 
evaluated due to the lack of suitable trajectory information on which to base 
the analyses. Bum times of 300 to 400 seconds would be required most of 
which would occur at or near 60 n.mi. altitude. The picture would not be 
too unlike the low altitude arrival with the exception that altitudes and 
relative velocities during the full-power interval would be lower suggesting 
higher peak doses. While the resulting conditions on the surface should not 
be considered as indicative of a problem, they should be considered in plan- 
ning surface activities if nuclear lunar shuttles are employed. 

6. EFFECT OF NERVA EXHAUST PLUME ON ORBITING LUNAR ELEMENTS 

During nuclear engine operation fission products can be ejected from the core 
either in particulate matter produced by corrosion of the fuel elements or 
as gaseous material diffusing through the fuel matrix. Since these fission 
products will be carried along in the exhaust, they could theoretically repre- 
sent a hazard to systems such as the OLS or Lunar Tug which subsequently pass 
through the expanded exhaust plume or to the RNS itself which during retro 
maneuvers will sweep through a portion of its own plume. 

Little is known either about the size and mass distribution of the NERVA ex- 
haust plume or the concentration of fission products within it, however, West- 
inghouse Astronuclear Laboratory has conducted a preliminary evaluation of 
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the impact of radiation sources in the plume on manned orbital facilities 
(Ref. 3 ). From their analyses, which were intentionally conservative, it 
appears that no radiological hazard to men or equipment will result if passage 
through the plume occurs after it has achieved its full expansion. Situations 
in which only partial expansion has taken place when a manned system enter 
the plume, such as would occur for an RNS departing lunar orbit from a posi- 
tion ahead of the OLS, have not been examined to sufficient depth to draw 
valid conclusions, however, preliminary assessment for RNS startup 20 n.mi. 
or more ahead of the OLS suggest the dose levels from the plume sources at 
the OLS will be sufficiently reduced to eliminate it as a serious source of 
radiation expo sure . 

A possible exposure-producing situation is one which might arise from the 
capture of radioactive particulate matter by the exterior surfaces of the OLS 
or other manned vehicle systems. Subsequent EVA activities involving contact 
with the contaminated surfaces could result in a transfer of particles to 
the crewman' s space suit or equipment and a potential direct skin contact or 
ingestion if the suit were handled after return to the spacecraft cabin. 

While a theoretical exposure route can be postulated, the potential for sig- 
nificant exposures is considered too remote to be of concern since the par- 
ticulate matter would be very small containing an insufficient fission 
product inventory to be hazardous even if a large number of such particles were 
involved. However, on early missions involving the RNS it would be desirable 
to perform inspections of surfaces exposed to the NERVA plume to determine 
how much contamination, if any, could be expected. 

Catastrophic failures such as loss of coolant to the engine causing destruc- 
tive disassembly of the reactor could result in hazardous conditions at or 
near the OLS or other space elements. Depending on the location and concen- 
tration of the radioactive debris it is conceivable that mann ed activities at 
the OLS might have to be restricted or discontinued until sufficient disperse- 
ment of the debris had taken place. Steps are being taken in the NERVA and 
nuclear shuttle designs to reduce such accidents to incredibility, however, 
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procedural safeguards including methods for detection and evaluation covering 
such contingencies would be desirable. 

7. OFF-NOMINAL RNS OPERATIONS AND THEIR HAZARD POTENTIAL 

Some consideration should be given to the possibility of the RNS operating 
in an off-nominal manner and what impact such operations might have on the 
safety of the RNS or other orbiting space elements. For convenience off- 
optimum operations will be constrained to those operations which result from 
human error or system malfunctions which do not result in mission abort. Three 
co ndi tions were considered which fall into this class: (1) lunar approach 

guidance errors which cause low altitude LOI burn and/or operation close to 
the OLS, (2) guidance errors during the pulse cooling orbit insertion which 
could threaten the OLS with collision or close passage radiation exposure 
and (3) reductions in thrust at LOI which could alter bum duration and loca- 
tion relative to the OLS with final orbit insertion in other than the in- 
tended orbit. 

Approach Guidance Errors . Approach asymptote errors would require an adjust- 
ment in the scheduled f ull -power engine operation at LOI and if the error was 
on the low altitude side, could result in performing the LOI bum close enough 
to the OLS to be of concern. Off-nominal approaches might be discovered too 
late to correct, but would be known far enough in advance to permit evaluation 
of the potential hazard which could result if insertion into the planned orbit 
was attempted. In the event an unacceptable hazard was predicted, injection 
into the planned orbit would be abandoned. A delayed LOI bum could be sub- 
stituted, to provide improved separation and view angle, injecting the RNS in- 
to elliptical orbit with later transfer to the OLS orbit. In this manner the 
radiation hazard to the OLS could be avoided although a performance penalty 
for the Earth- return leg would be encountered. 
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Guidance Errors During Pulse Cooling LOI . Guidance errors during the cool- 
down orbit insertion phase are probably the most likely area where off-nominal 
operations are apt to be encountered . Such errors could accidently place the 
RNS in an orbit which could cause a collision or very close passage with the 
OLS. Preventing a catastrophic event of this type will require frequent up- 
dating of the RNS orbital parameters to insure prompt discovery of such a 
condition. A small velocity impulse either with the RCS system or a subse- 
quent cooling pulse could be used to avoid a collision. Effect of close pass- 
age can be minimized by maintaining a nose-on attitude of the RNS during the 
period of concern. Initiation of cooling pulses during the close passage can 
be delayed or commanded early, as appropriate, to avoid thrusting during the 
passage, or if necessary, a direct opposition of the coolant thrust using the 
RCS system could be considered if a pulse were mandatory during the close 
passage time interval. 

Reductions in Thrust During LOI Bum . Reductions in thrust may be encountered 
during the main lunar orbit insertion bum due to malfunctions in either stage 
or engine systems. If the situation were unanticipated (no prior warning that 
full thrust could not be achieved), insertion into the planned orbit in a 
single bum could not be accomplished. Instead, the reduced thrust arrival 
bum would brake the RNS into elliptical orbit. Near apocenter an idle mode 
NERVA bum could be used to reduce the pericenter altitude to 60 n.mi. and 
finally a third bum near pericenter would be required to circularize the 
orbit. Additional phasing of the RNS in circular orbit might be required 
after circularization unless the elliptical orbit period was carefully syn- 
chronized with the OLS. 

In the above case, initiation of the arrival bum would be at the planned dis- 
tance from the OLS and while the bum time would be increased due to the 
lower thrust, the reactor power would, in all probability, be proportionally 
lower, thus reducing the radiation environment at the OLS. As long as care 
were taken to avoid the need to perform the final circularization bum in an 
adverse manner (near the OLS and with a bad view angle), no increase in 
radiation dose at the OLS is anticipated. 
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If prior knowledge that reduced thrust were to be required is available, the 
approach asymptote could be adjusted and the bum initiation scheduled so 
that a single bum LOI could be performed. Again the bum time would in- 
crease due to the lower available thrust a and while the approach altitude 
would be lower, the reduced reactor power level would probably preclude any 
increase in the radiation environment at the OLS. 

REFERENCES 
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2. Aerojet General Corp. RN-S-0551, "Full Flow Flight Engine Common Radia- 
tion Analysis Model," Sacramento, California, 1969. 
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Pennsylvania, 26 January 1970. 
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Figure 5 - ^-ssion Product Gamma Dose Rate vs Distance from the ~~ 
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Figure 6 - Effect of View Angle on Fission Product Gamma Dose Rats 
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Figure 7 - Lunar Orbit Insertion Using Cooldown Pulse 
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Figure 8 « Typical Three-Burn Lunar Departure With 90* Plane Change 
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Figure 11 - RIS-OLS Separation Distance During First Burn 
of Three-Burn Lunar Departure Maneuver 
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Figure 12 - RMS View Angle fro* OILS IXirlng Firet Burn 
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Figure 13 - Relative Location of Lunar Surface Poe It Iona With Respect 
to RR3 Incoalng Trajectory - Lov Altitude Approach 
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Figure lb - RNS View Angle From Indicated Surface Positions 

During Low Altitude LOI Burn 
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SUPPLEMENTAL DATA REPORT NO. 2 
SOME PROS AND CONS ON THE "BUDDY SYSTEM*' FOR EVA 


INTRODUCTION 


* 



A central issue regarding EVA operations is the question of the number of EVA 
astronauts to commit simultaneously to the potentially hostile lunar surface 
or lunar orbit space environment. The "Buddy System" concept, which had its 
origins in the militaiy realm, as applied to space activities involves the 
commitment of at least two astronauts at a time for all activities so that 
each can look out for and assist the other in the face of some d an ger which 
threatens one of the astronauts. The "Buddy System" offers immediate proxim- 
ity of assistance in case of a variety of problems, both anticipated and un- 
foreseen which may arise. Counter-arguments to the Buddy System include the 
consideration that the danger or hazard which affects one astronaut, i.e., 
much like the drowning swimmer dragging down his rescuer. Ensuing para- 
graphs explore a variety of considerations which affect the advisability of 
the "Buddy System" during lunar space activities. 

DEFINITION OF BUDDY SYSTEM 


*r 


♦ 



The buddy system is defined as that operational mode of activity wherein at 
least two members of a space mission crew perform tasks with both (all) 
members conducting tasks while near each other at the same site. The buddy 
system necessarily includes the capability for each crew member to use the 
subsystems of his fellow crew member by the existence in their' equipment of 
hardware which permits such mutual (multiple) use. It may include 2 tugs, 2 
flyers, 2 rovers, separated bases, etc. 

Thus, if each of M crew members carries N subsystems (life support, communi- 
cations, power, etc.), there are then MN subsystems for their support. 
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The psychological comfort of having a fellow crew member immediately available 
in the event of accident, equipment malfunction, illness, or any other irreg- 
ularity serves to greatly increase the confidence of the buddy system crew. 

By no stretch of the imagination can the buddy system be considered to be in 
effect if one member of the team is outside a spacecraft or lunar base while 
his monitor (s) is inside the spacecraft or base; no matter whether the latter 
is suited-up or not. 

CREW SIZE AMD FUNCTION 

A basic consideration in establishing the requirement for the "Buddy System" 
in a given system is the basic crew size and the functions which the crew 
must perform to maintain a viable habitat. For example, a two-man crew asso- 
ciated with a lunar shelter offers minimal flexibility if one man must con- 
tinuously monitor habitat life support and other critical systems to cope imme- 
diately with a possible equipment system malfunction. In this context, an- 
other consideration is the extent to which Earth surveillance of the lunar 
habitat is provided so that habitat system malfunctions can be reported im- 
mediately to the crew during periods when both men are EVA. 

As crew size becomes larger, the issue of availability of a second or buddy 
astronaut assumes less importance. With a three-man lunar habitat crew, 
one man can remain in the habitat to monitor critical systems while the other 
two can assist each other during EVA operations. When the crew numbers four 
or more, a greater degree of flexibility and safety can be achieved by com- 
mitting two astronauts to the lunar EVA environment, while a third remains 
in the airlock in a suited pressurized condition ready to assist one or both 
of the EVA astronauts as required. The fourth man remains behind the monitor 
vehicle/shelter systems. 
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CASES WHERE THE BUDDY SYSTEM PRODUCES SAFETY ADVANTAGES 

Aside from safety considerations, there are many EVA tasks which can be per- 
formed more expeditiously by two men working together as opposed to a solo 
effort. Safety advantages are envisioned in the following instances: 

1 • Motion Sickness Effects . Nausea induced by motion effects may occur as 
a result of lunar vehicle motion over the lunar surface or through un- 
controlled spinning or tumbling during lunar orbit EVA operations. In 
addition, nausea in the space suit may occur as a result of illness. 
Hazards associated with vomiting in a space suit have been elaborated 
upon in Hazard Study 35 • Due to the generally incapacitated state of 
the motion-sick astronaut, including possible obscuration of the visor, 
a "buddy” astronaut is highly desirable in terms of guiding and assisting 
the disabled astronaut as soon as possible to a safe haven. This is 
especially important in the case where the astronaut is operating with 
a cabinless lunar rover some distance from the shelter, and during lunar 
orbital EVA. 

2. Suit/FLSS Damage or Malfunctions . Hazards inherent in EVA operations 
include suit rupture, portable life support system failures or possible 
interruption of life support provisions in switching from one back-pack 
to another during EVA. In each of these cases, depending on the rate of 
escaping life support gases and depressurization, immediate assistance 
rendered by a buddy astronaut can make the difference between saving or 
losing the astronaut whose extravehicular mobility unit (EMU) has been 
compromised. The "buddy" astronaut, as described more fully in Hazard 
Study 23, can aid the endangered astronaut by assisting him to hook on 
to a spare PLSS or vehicle mounted ECS System, share his own PLSS with 
the astronaut, and/or help guide the astronaut to a safe haven. 

3* Dysbansm Ef fects . Physiological problems may arise when the astronaut 
transitions from higher pressure, mixed gas lunar base or shelter en- 
vironments to the 3.5 psi, pure oxygen space suit environment. These 
symptoms, e.g., the bends, are described in detail in Hazard Study 
39. Since it is unlikely that the onset of these disabling symptoms 
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would strike two EVA astronauts simultaneously, the affected astronaut 
could be returned to a safe shelter and recompressed at higher pressures 
with the assistance of a buddy astronaut. For example, an astronaut 
suffering severe bends symptoms might have serious difficulties in 
safely guiding a lunar rover back to a lunar shelter on his own. 

Operational Accidents . In addition to the above-mentioned categories of 
established and well-defined potential hazards, there are a variety of unpre- 
dictable accidents that may occur in the course of normal EVA operations 
where a buddy astronaut could provide immediate assistance. Such representa- 
tive accidents include: 

1. Falling into a crater or injury from other lunar surface physical hazards. 

2. Lunar vehicle overturn. 

3. Falling off platform of lunar roving vehicle. 

4. Tripping over emplaced items of scientific equipment. 

5. Snagging of hoses connecting suit and PLSS. 

6. Injury from manual deployment of lunar hardware; scientific or axuiliary 
vehicles. 

7. Uncontrolled spinning or tumbling during lunar orbit EVA. 

8. Minor tear, puncture, or rupture of pressure suit. 

In addition to providing assistance subsequent to any of the aforementioned 
types of accidents, the "buddy” astronaut can serve an important role in the 
prevention of these accidents. The encumbering space suit restricts the 
astronaut's senses. Vision is limited, hearing is curtailed and the cutaneous 
or touch sense is largely voided by the enveloping space suit.. For these 
reasons, two pairs of eyes may well be better than one in anticipating po- 
tential dangers. Certainly there are sufficient precedents from diving to 
mountain climbing to justify the buddy system when operating in hostile en- 
vironments. 

Crew Error . In case of crew error on the part of one crewman the buddy astro- 
naut is present to monitor and prevent or aid in remedying the error. 
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CASES WHERE THE BUDDY SYSTEM MAY JEOPARDIZE BOTH ASTRONAUTS 

As we mentioned earlier, an argument against the "Buddy System" is that a 
hazard or danger which threatens one astronaut, could envelope both astro- 
nauts. With a small crew, this could jeopardize not only the crew, but the 
entire mission. Environmental hazards that might simultaneously affect both 
EVA astronauts include: 

1. Meteorite showers. 

2. Periods of solar radiation intensity. 

3. Moon quakes. 

In addition to these environmental hazards we must also consider the case 
where in attempting to rescue a disabled astronaut, the assisting astronaut 
is ensnared in the same dangerous situation, thereby compounding the serious- 
ness of the situation, e.g., an astronaut who is injured attempting to retrieve 
his companion from a crater floor. 

CONCLUSIONS 

The safety advantages inherent in the "Buddy System" mode of operation gener- 
ally outweight the probability that both EVA astronauts mill be enveloped in 
a common catastrophe. This generalisation definitely applies where the avail- 
able crew complement numbers three or more. 

Where only two crew members are available to man a lunar habitat, it becomes 
imperative to weigh the system monitoring requirements for preserving a safe 
habitat against the safety and operational benefits accruing from simultaneous 
EVA activities, leaving the shelter unattended. The shelter, under these cir- 
cumstances, can be left unattended only where remote surveillance of critical 
systems is available to alert the astronauts to return to the shelter and 
attend to malfunctions in a timely fashion. 
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When solo astronaut EVA operations are indicated because of 'overriding' 
concern for habitat system monitoring, the astronaut who remains in the 
shelter should be suited/pressurized and on standby to aid the EVA astronaut, 
as required, in an emergency. Provisions should be made for visually moni- 
toring the EVA astronaut's activities, and the shelter and EVA astronauts 
should be in constant communications contact. EVA excursions from the 
shelter under these circumstances should be limited. 
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SUPPLEMENTAL DATA REPORT NO. 3 
SUGGESTIONS TO IMPROVE SAFETY AT A LUNAR SURFACE BASE 

INTRODUCTION 

This supplemental study presents some ideas for improving personnel safety 
at a lunar surface base through attention to basic site layout, deployment, 
crew ingress/egress, and deployment of scientific equipment. 

LUNAR SURFACE BASE SITE LAYOUT 

There are many ways in which to arrange a lunar surface base to enhance the 

safety of the crew, and many trade-off studies can be performed to ensure 

maximum protection for the crew. Four major approaches are shown on Figure 
1, along with a summary description of the major advantages and disadvantages 
of each site layout. 

Of particular importance is the distance between the lunar base itself and 
the tug landing sites, the major hazard being damage to the personnel shelter 
through bombardment by secondary ejecta thrown up by the tug's engine plume 
during final approach, touchdown and take-off. Reference 1 recommends a 
minimum distance of one mile, based on ejecta damage requirements, and a 

maximum distance of l-j- miles based on crew walking capability. 

There are a variety of ways to reduce this plume impingement problem by pre- 
paring the landing site to be used by the tugs. The initial landings, of 
course, will not have this luxury unless the sites are prepared remotely, a 
not very likely possibility. Figure 2 summarizes some approaches that could 
be used to protect the base. 

The problem of having the tug landing site about a mile from the base intro- 
duces hazards also. If there will be tug landings and take-offs at the rate 
of one every two months and entire crews are to be exchanged every four months, 
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there will be much ingressing and egressing and donning and doffing of space 
suits back-packs and getting up and down the sides of the base and tugs 
(the equi valent of a nine- story building) . If the crews do not walk, they 
will have to be clambering on and off slow moving and complicated roving ve- 
hicles, all of which introduce hazards of their ownj in other words, it will 
be a constant battle with the dusty lunar surface and the ingenious equipment 
designed to travel on that surface. It is, therefore, suggested that to re- 
duce the hazards of the lunar surface base consideration should be given to 
the elevated crew and cargo transfer system shown on Figure 3 whereby, after 
initial set-up, the astronaut need never touch the lunar surface for routine 
cargo handling purposes and crew exchanges. 

DEPLOYMENT OF LUNAR SURFACE BASE 

The major activities for setting up the base, once the site has been prepared, 
are unloading the cargo from the tugs, transporting cargo from tug landing 
site to base site, and possibly some degree of lunar soil handling. Figures 
4 through 7 list some of the most likely methods and equipment to be used, 
crew activities associated with those methods, and some of the safety prob- 
lems and requirements which will emanate from that activity. 

CREW INGRESS/EGRESS 

The major problems associated with ingress and egress are dysbarism (see 
Hazard Study 39, airlock operation reliability, extravehicular mobility 
unit reliability, and contamination. The lunar surface base atmosphere is 
most likely to be a two-gas (° 2 +N 2^ atmosphere, whereas the pressure suit 
the astronaut wears is probably going to be 100$ oxygen as in the Apollo 
program. The effects (e.g., denitrogenization) of switching from a high 
pressure two-gas atmosphere to a low pressure, 100$ oxygen, suit atmosphere 
and vice-versa are the subject of continuing study by the various environ- 
ment control and life support system experts working on the space station 
and lunar base studies, and are too complicated for thorough research in 
this study. The major difficulties will not be the nominal operation of the 
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airlock/ shelter/ suit interface but rather the emergency conditions requiring 
fast reaction by the crew. One suggestion is offered here which may be pert- 
inent is that, during a tug rescue mission from the orbiting lunar station 
to the surface, the time between separation from the station and touchdown on 
the surface could be used to change the tug atmosphere from two-gas to 100$ 
oxygen so that when the rescued crewmen are brought on board they will not 
have denitrogenization problems, and during the return flight the change could 
be reversed. 

The physical business of getting into and out of the base to the lunar sur- 
face has some hazards which are summarized on Pig. 8. A basic requirement is 
to be sure the stairs, elevator, or whatever means is chosen for getting up and 
down is at least big enough to accommodate one prone stretcher case plus a 
suited astronaut; all doors, hatches and airlocks should also be designed 
with the stretoher case in mind; the height of the door sill from the lunar 
surface should be kept to a minimum. 

It is suggested that the base/cabin rover interface be designed such that 
the driving crew can make a shirtsleeve ingress/egress between the two struc- 
tures. The idea is illustrated in Fig. 9. Such a scheme would save valuable 
time during a rescue mission by the cabin rover. 

DEPLOYMENT AND OPERATION OF SCIENTIFIC EQUIPMENT 

The hazards involved with deployment of scientific equipment are basically 
those associated with EVA activity while setting up, erecting and operating 
such large and diverse structures as a 300 meter drill and the enormous 
telescope complex which extends 5.6 miles across and is 10 miles away from 
the main base as shown in . Reference 2. Unless some form of auto- 
mation for deploying such items is worked out, very long periods of EVA and 
driving, with their associated hazards, will be necessary. Wherever possible 
all equipment operations should be automated. For some of the equipment a 
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remote temporary shelter could be used to shorten driving time and double as 
an emergency safe haven; something like the Goodyear self-erecting shelter 
(Ref. 3) could be put to good use here since it is lightweight and transport- 
able. 

REFERENCE AND DATA SOURCES 

1. 70 MA5828 NR Space Tug, Logistic Vehicle Parameters, July 1970, pp 19-27 

2. PD 70-40 Lunar Base Synthesis Study, First Interim Progress Report, 

North American Rockwell, October 1970 

3. GET-12246 - Lunar Staytime Extension Module - Goodyear Aerospace Co. 

4 . LMSC/A 6656 O 6 , LESA Deployment Procedures, Lockheed Missiles & Space 
Company, Sunnyvale, February 1965 
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T.TTNAR SURFACE BASE - HAZARDS ANALYSIS - DEPLOYMENT OPERATIONS 


CONCEPT 


SPECIAL 

EQUIPMENT 


CREW 
ACTIVITY 


SAFETY ASPECTS 


]jNo special preparation 
Locate landing sites 
widespread from each 
other 

o Locate base in 
natural crater 


None 


None 


Tr&nspor la Lion to ana irom 
base to tug sites; tug 
maintenance may require 
temporary shelter at tug 
site for work crews 


m Blast Walls 


A 





JPre-Fab Wall 
"" 1 \ 


Bulldozer; 

Lifter; 

Carrier 


Lifter; 

Assembly Tools; 
Foundation Pads 


3) Prepared Surface 







Bulldozer; 

Scraper/ 

Leveller; 

Soil Carrier; 

Chemical 

Solidifier? 


4) Rigid Landing Pads 



Bulldozer; 

Scraper/ 

Leveller; 

Soil Carrier?; 

Assembly Tools; 

Tie-Downs; 

Foundations; 

Trailer for 

transporting 

panels 


Extensive 

Driving 


Extensive 
EVA for 
offloading 
and assembly 


Wall probably not very high 
requiring fair separation 
distance; 

Same as l) 


Wall could be high and close 
to base, or low and away 
from base; very reliable 
foundation required 


Extensive 

Driving 


Extensive 
Driving 
and EVA 


Testing of effectiveness of 
actual site required before 
commitment of LSB; probable 
that loose material can be 
ej ected 


Provides excellent control of) 
the engine plume once the 
set-up problems have been 
overcome 


SAFE DESIGN CONSIDERATIONS 

o Landing gear spread 
o Landing loads, velocities 
o Proximity of beacon 
o No. of landings 
o Angle of repose of soil 


o Soil properties 
o Engine exhaust velocity 
o Ht. above ground at engine cut-off 
o Reusability 

o Damage to tug nozzle & heat shroud 
o Type of soil at sites 
o One big site vs several sites 


Fig. 2 Site Preparation 
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Fig. 3 Typical Lunar Base Complex Elevated Crew and Cargo Transfer System 
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LUNAR SURFACE BASE - HAZARDS ANALYSIS - DEPLOYMENT OPERATIONS 


CONCEPT 


CREW 

ACTIVITY 


SAFETY ASPECTS 


A Frame With Hoist 




EVA on top 
deck & sur- 
face; 

Controlled 
by both 
crewmen; 
intercom 


Handling cables may be required to 
prevent swinging; handrails required 
on deck; emergency equipment required 
on top deck and at surface 


2 ) Ramp 



EVA on deck 
and surface; 

Extensive 
EVA for 
assembly 


Should payload get stuck on ramp - 
EVA activity may be required on rails, 
dangerous; 

Provide walkway and handholds along 
rails and deck 


3) Hoist Platform 



Same as 

2 ) 


Same as 2) ; 

Probably require much EVA for 
main ten; ance; 

Ladders required 


4) Davits 



EVA on 
deck and 
surface 


Extensive intercom between deck and 
surface crews; may require cables to 
prevent swaying of payloads into 
vehicle and crew 


5) Monorail & Hoist 




Same as 
4) 


Same as 4) 


SAFE DESIGN CONSIDERATIONS: 

o Perform jobs remotely where 
possible 

o Use buddy system (on deck & surface) 


o Multiple intercom capability 
o Reduce handling time to minimum 
o Provide crew danger warnings 
o Simulated training devices 


Fig. 4 Unloading 
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LUNAR SURFACE BASE - HAZARDS ANALYSIS - DEPLOYMENT PROCEDURES 


CONCEPT 


CREW 

ACTIVITY 


SAFETY ASPECTS 


l) Bicycle Transporter With 



EVA for 

installation of 
tracks, wheels, 
etc ; 

EVA for control 
Road Building 


Unless provided with good road, 
especially for outriggers the whole 
assembly would get stuck, damaged 
or tip over 


2) Two Wheels Plus Large 
Rover 



EVA for 
disassy. of 
landing gear; 
assy of wheels; 
driving/ towing 


Requires very good road; shelter/ 
cargo will want to pitch forward 
and backward which may overload 
Rover; requires observers outside 
of Rover 


3) Four Wheel Trailer Plus 
Large Rover 



Similar to 

2 ) 


Good road required though not as 
critical as 2); requires observers 
outside of Rover 


4) Four Wheel Trailer 



EVA for disassy 
of landing gear 
assy of wheels; 
and for con- 
trolling 
steering 


Same as 3) 


5) Wheels attached to 
Landing Gear - Self 
Propelled 



EVA for wheel 
attachment 
and 

control 

steering 


Same as 3) 


SAFETY CONSIDERATIONS: 

o All concepts require extensive EVA for assembly unless the wheels, 
trailers, controls, etc. can be built-in and then remotely hinged or 
folded out after landing. 

o Control & steering could be remote? 


Fig. 6 Transportation of LSB and Cargo Modules 
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LUNAR SURFACE BASE - HAZARDS ANALYSIS - DEPLOYMENT PROCEDURES 


CONCEPT 


CREW ACTIVITY 


SAFETY ASPECTS 


1 ) Backhoe 



Driving; EVA for 
installation of 
special purpose 
attachments 


Special dust & falling rocks pro- 
tection required (at windows especial- 
ly) 5 good visibility required under 
all operating conditions; maybe de- 
sign attachments so they can be in- 
stalled without EVA 


2) Dragline 



EVA for set-up 


Possibly good for remote Ops; some 
difficult EVA maintenance chores; 
infallible foundations required 




3 ) Soil Thrower 



Driving ( towing) ; 
EVA for set-up 
alignment 


Doubtful if soil can be accurately 
thrown; control problems; poor 
visibility 




4) Soil-Box/Trailer/Rover 



Driving; 

Attachment hook up;| 
Controls EVA for 
set-up 


Will require sophisticated controls 
to get accurate function; avoid 
backing-up type situations. 


5) Bucket Conveyor 



■Driving (towing); 
set-up EVA for 
(repositioning 


Probably much EVA for maintenance; 
will be difficult & dangerous to 
inspect during operation 


SAFE DESIGN CONSIDERATIONS 

o Use automation & remote control, checkout, 
assembly, etc., wherever possible 
o Design must consider soil effects on 
machinery & materials 

o Protection req r d around all moving parts 


o Minimum maintenance 
o Maximum accessibility 
o Extensive training programs 


Fig. 7 - Soil Operations 
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LUNAR SURFACE BASE - HAZARDS ANALYSIS - DEPLOYMENT PROCEDURES 


CONCEPT 


CREW ACTIVITY 


SAFETY ASPECTS 


l) Ladders 






■ 



L 

^ y 



Climbing/ 

Walking 


Requires both hands and both feet; 
backwards descent; difficult for in- 
jured crewman and extremely difficult 
for stretcher case; equipment trans- 
fer slow; possible to fall or become 
entrapped; requires extensive hand- 
rails, platforms, etc. 


Spirals 


2) Hoist Platform 



Hoist Control; 
Standing 


Possible temporary isolation of crew- 
men; will require back-up system of 
ladder or hoist; possible swaying; 
should be big enough to take stretcher] 
case plus one other crewman 


3) Rigid Elev ator Platform 



Hoist control; 
Standing; 
Assembly 
EVA 


Possible temporary isolation of crew- 
men; if mechanical failure occurs 
structure can be used as ladder/ 
platform; should be big enough for 
stretcher case & 1 crewman 


4) Travelling Airlock 



Airlock control;] 
Standing; 

Rail assembly 
EVA? 


Requires back-up system; should be 
big enough for stretcher case, etc. 


5) 


Moving Stairs, or 
Large Fixe d Sta irs. 



EVA for 

assembly; 

Standing 


Requires handholds/platform; 

May have some problems for injured 
crewmen/Stretcher boarding problems?; 
Probably require a fair amount of EVA 
for maintenance; protection required 
for all moving parts 


Safety Considerations: 

o Door sill should be as close to ground as possible, 
o Intercomm required during all operations (to surface & shelter) 


Fig. 8 - Ingress/Egress Operations 
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Fig. 9 Rover/Base Shirtsleeve Transfer Scheme 
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SUPPLEMENTAL DATA REPORT NO. 4 


CREW MODULE MINIMUM VELOCITY REQUIRED WHEN LEAVING A ROTATING NUCLEAR PRIME 
TRANSPORT VEHICLE (PTV) 


For the case of a crew module effecting an emergency departure from a 
rotating* nuclear PTV, the question arises as to the minimum separation 
rate needed to minimize crew radiation exposure from the NERVA engine. The 
initial assumption is made that the crew module is provided with a pyrotechnic 
separation device which permits a rapid, clean separation response. The 
separation rate is then a function of the tumbling rate of the PTV and the 
crew module/PTV-c.g. moment arm. 


As a first approximation, the crew exposure calculations were computed for 
a crew module leaving a rotating nuclear PTV with only the relative velocity 
imparted by the rotating vehicle. For comparison sake, two PTV angular rates 
were postulated; l°/sec and 6°/sec. For the initial calculations, it was 
convenient to use NERVA engine radiation data for an engine which had been 
shutdown for one hour. Other radiation levels could then be considered by 
extrapolation from related data source graphs. 


Figures 1 and 2 present the radiation exposure pulses to the crew module as 
it leaves the vicinity of the rotating nuclear PTV with only the initial 
relative velocity imparted by the angular rate. The vehicle configuration 
data and mass properties data were adapted from Ref. 1. 


For the first eleven exposure pulses the integrated radiation dose to the 


crew is given as follows: 

Engine Shutdown Time 

1 hr 
1 hr 

0.5 hr 
0. 5 hr 


Tumble Rate 



Crew Exposure 

42 REM 
7 RM 


l°/sec 253 

6°/sec 44 REM 


*The rotation assumed here is rotation about an axis perpendicular to the 
longitudinal axis of the PTV 
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The radiation source data employed in the calculations are presented in Supple- 
mental Data Report No. 1, Appendix E, of this report. 

The calculations illustrate that escape from a l°/sec rotating nuclear PTV 
presents a requirement for crew module propulsion capability. For the l°/sec 
case the crew module leaves the PTV with a relative velocity of 1.18 ft /sec. 

In order to reduce crew exposure to acceptable limits it would be desirable 
to have a crew module A V capability of approximately 100 ft /sec and a thrust- 
to-weight ratio of 0.1 or higher. A capability of this magnitude would 
permit crew module escape at any time after nuclear engine shutdown with low 
crew exposure values. 

DATA SOURCE REFERENCES 

1. Nuclear Shuttle System Definition Study - Phase III, tenthly Progress 
Report, LMSC/A980259, November 15, 1970. 
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SUPPLEMENTAL DATA REPORT NO. 5 

POTENTIAL HAZARDS FACED BY THE APOLLO 14 LUNAR SURFACE ASTRONAUTS 

Very good indications of the difficulties that could be encountered by astro- 
nauts on future lunar missions requiring navigation procedures and the setting 
up of experimental equipment were found in the transcript of communications 
for the Apollo 14 mission. 

In Hazard Study 26, Lunar Surface Lighting during Rover Traverses, the effects 
of travel over the lunar surface during periods of high sunlight angles are 
discussed. Some of the highlights of that stuffy point to the problems that 
are faced by astronauts in a rover under the conditions of high sun angles 
which wash out surface detail to a very large degree. Navigation using surface 
features under such conditions becomes a difficult - if not impossible - task. 
Surface glare creates the impression that over wide areas in view there are no 
depressions or small craters, just a flat featureless plain. Such an impression 
would raise havoc with attempts at navigation. While it is undoubtedly true 
that the rover crew would be able to drive out of many craters that they un- 
knowingly drove into, there are altogether too many possibilities that could 
lead to problems. Much of this navigation problem would be faced by EVA astro- 
nauts. The EVA astronauts would see craters and other obstacles as they got 
close, and so would avoid most, if not all of them. However, after traversing 
some thousands of feet on foot, it becomes difficult to know just where one 
is located or, indeed, where particular objects are - like the Cone Crater, 
for example. Thus, in the Apollo 14 transcript, at about 132.5 hours into 
the mission, the astronauts state their uncertainty of the way to Cone Crater. 

At about 133 hours into the mission they note that "the sun angle is.... very 
deceiving" . 

Earlier in the transcript they claim difficulty in reading flags or scales on 
the PLSS in the bright sunlight. These are, of course, important parameters 
and should be reada b le all the time, independent of lighting, location, etc. 

The lighting conditions contributed to entanglement in various cables (Ref, 
Hazard Study 20) . Thus at one point one of the Apollo 14 astronauts is en- 
tangled in the TV camera cable - for the second time. Later, such entangle- 
ment with the same TV cable is noted as occurring a third time. Elsewhere an 
astronaut notes that some cable he is reeling in has become "....a mass of 
spaghetti . . . . " - again, a potential problem of entanglement. 
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In reference to Hazard Study 23 (Hazardous Operations with EMT-EMEJ Malfunc- 
tions) where several suit design improvements were suggested so as to avoid 
the hazards of loosely hanging hoses, there are incidents shown in the tran— * 
script to support the design changes discussed. During the Apollo 14 mission 
an astronaut's PLSS hose became kinked and resulted in delay of EVA. At one 
time an astronaut's PLSS hung up on the LM hatch handle. Later the LMP dis- 
covered he had inadvertently hit a transmitter switch, turning it off, thus 
giving rise to a communications problem which delayed EVA for a while. 

There were some lesser problems involving identification of film magazine* - 
which ones were used, and which were still usable; leaking (tom) lunar 
sample bags; the need for a sight for aiming the lunar surface TV camera; 
and, finally, the toppling of instruments when relatively rigid cables were 
attached to them, during first EVA. 
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